Supply chain · pip · High

Malicious 'infrabench' (pip) Package Deploys Coin Miner

Threat Engine Auto-Feed · data current as of 2026-10-04

A malicious package named 'infrabench' (version 0.1.0) in the pip ecosystem has been identified as deploying a coin miner. This critical supply-chain threat affects any systems that installed this specific version, potentially leading to unauthorized resource consumption and performance degradation.

  • Package: pip / infrabench
  • Affected versions: = 0.1.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Crypto / wallet targeting

The 'infrabench' package (version 0.1.0) on PyPI was found to contain malicious code. Instead of performing its advertised function, it deploys a coin miner on the system where it is installed.

How the attack works

This is a software supply-chain attack where a seemingly legitimate package is compromised or created with malicious intent. When a developer or automated system installs the specified version of the package, the embedded malicious code executes, establishing a persistent presence to perform unauthorized activities, in this case, cryptocurrency mining.

Who's exposed

Profiles most at risk

  • Development teams using the pip ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest dependencies
  • Any system or environment where 'infrabench' version 0.1.0 was installed

Conditions that increase exposure

  • Unpinned dependencies in project requirements files (e.g., requirements.txt without specific versions)
  • Lack of dependency lockfiles (e.g., Pipfile.lock, poetry.lock) that ensure deterministic builds
  • Use of internal package mirrors that do not vet packages for known malicious content
  • Automated build processes that install dependencies without review

Blast-radius scenarios

  • If installed, the package will deploy a coin miner, leading to unauthorized resource consumption (CPU, electricity) on the affected system.
  • Compromised systems may experience performance degradation and increased operational costs.
  • The presence of a coin miner could indicate a broader compromise or serve as a foothold for further malicious activity.

What to do (defensive)

Detect

  • Scan dependency trees for 'infrabench' version 0.1.0 across all projects and environments.
  • Monitor system resource utilization (CPU, network) for unexpected spikes or persistent high usage indicative of unauthorized mining.
  • Review package installation logs for 'infrabench' 0.1.0.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages in your dependencies.

Contain

  • Immediately quarantine or isolate any systems identified with 'infrabench' version 0.1.0 installed.
  • Block 'infrabench' version 0.1.0 at your package registry or proxy to prevent further installations.
  • Review and update dependency management practices to pin versions and use lockfiles for all projects.

Remediate

  • Uninstall 'infrabench' version 0.1.0 from all affected systems.
  • Perform a thorough forensic analysis on compromised systems to ensure no other malicious components were introduced.
  • Rebuild affected environments from trusted sources, ensuring all dependencies are vetted and explicitly versioned.
  • Implement stricter supply chain security controls, including dependency vetting and integrity checks.

Frontier verdict — High

Prioritize immediate detection and removal of 'infrabench' 0.1.0 due to its critical severity and coin mining payload.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.