GitHub Advisory malware sweep - 2026-10-03 (late) + 2026-10-04 (10 pip `voxcpm*`/`voxel-tts`/`caoxiltts`/`infrabench` siblings of the `2026-10-voxeval` cryptominer campaign - continuation of yesterday`s `voxeval` NEW campaign entry, same OpenSSF campaign slug, CWE-506 "imitates real activity and instead deploys a coin miner"; 1 pip `echogen` generic install-time info-exfil pentest probe with no corpus siblings)

What happened

Between roughly 2026-10-03 12:00 UTC and 2026-10-04 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 11 new malware advisories, all in the pip ecosystem. The defensively notable shape of todays window: a 10-package mass expansion of yesterdays voxeval cryptominer campaign (2026-10-voxeval`), plus one unrelated generic install-time info-exfil pentest probe. No new npm, Go, or RubyGems advisories in this window.

Cluster A - 10 pip voxcpm*/voxel-tts/caoxiltts/infrabench 2026-10-voxeval cryptominer siblings

Ten pip packages co-published on 2026-10-03 UTC, batched into GHSA on 2026-10-03 (late window after yesterday`s ingest ran at 06:26 UTC):

The primitive. All ten carry the identical GHSA body text "imitates real activity and instead deploys a coin miner" and are tagged into the same OpenSSF campaign slug 2026-10-voxeval first used by yesterdays voxeval@0.4.2-0.4.5` Cluster E. Each package is a lure: on pip install it reports a plausible speech/eval/benchmark init-sequence while the real payload is a coin miner that persists for as long as the Python environment is active.

Target shape. The names deliberately piggy-back on the real VoxCPM open-source TTS model (OpenBMB, 2024-2025) and on adjacent audio-ML / LLM-eval naming:

• voxcpmruntime, voxcpmkit, voxcpmintel, voxcpmui3, voxcpmui4, voxcpmeval, voxcpmtts3 - all read as "a utility for working with VoxCPM" and a developer assembling a VoxCPM eval harness would plausibly pip install any of them.
• voxel-tts - looks like a different TTS model (voxel-based synthesis) rather than VoxCPM; a sibling lure.
• caoxiltts - unclear naming (possibly a misspelling / transliteration of a Chinese TTS brand); still slotted into the campaign.
• infrabench - sounds like an infrastructure benchmark harness; sits oddly in a TTS-themed campaign, suggests the operator is also probing adjacent ML-ops naming.

Operator continuity. The campaign slug 2026-10-voxeval was first used by yesterdays voxeval entry. Todays 10 siblings are the mass-publication wave that follows the single-sample seeding. Expect more siblings in the next 24-72 hours.

Classify as malicious-package for each. Severity high within the sweep (confirmed malicious payload, limited reach - only affects whoever installs the lure).

Cluster B - pip echogen generic install-time info-exfil pentest probe

echogen@1.0.0 (GHSA-w6gm-xv6q-cq55, source SHA-256 c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644, OpenSSF campaign GENERIC-standard-pypi-install-pentest, CWE-506).

Advisory body: "exfiltrates basic information about the host" such as IP addresses and usernames during installation, and "overrides the install command in setup.py to execute malicious code during installation."

The GENERIC-standard-pypi-install-pentest OpenSSF slug is the collector bucket for untargeted install-time info-exfil pentest probes that do not fit a named corpus. These generally come from one-off researcher accounts testing their reach against public-PyPI. No linkage to any other today-corpus campaign; no corpus siblings in the catalogue.

Classify as malicious-package (install-time beacon is confirmed malicious regardless of researcher intent). Severity medium within the sweep.

Operator continuity check

• voxeval cryptominer campaign (2026-10-voxeval): on day 2 of visible publications in this corpus (Cluster A, 10 new siblings today). Yesterdays voxeval` was sibling 1 of 12. The naming reaches across VoxCPM, voxel-TTS, generic bench, and transliteration-style names - the operator is testing which fake-brand variants grab installs.
• echogen generic info-exfil probe: NEW to corpus today (Cluster B), single-package, no corpus siblings.
• amel10 AWS API Gateway dep-confusion operator (Amazon/Alexa internal names): quiet today - yesterday`s six-package burst (Cluster A of 2026-10-03 sweep) is day 1 silent in the Oct 3 (late) + Oct 4 window.
• jexkcode/noverojs/xayz PhantomSub Baileys operator: quiet today after the 5-sibling batch yesterday.
• spo365-graph AWS Lambda + Secrets Manager pip operator: quiet today (yesterdays dedh-devops-automation` was day 2; today day 3 silent).
• Graphalgo Go-module expansion: quiet today after yesterday`s first-ever Go samples.
• friendly-greeting-tools/friendly-tools Snowflake credential-theft family (pkusinski-external S3): quiet today.
• sherpy/shortneer pip Chrome-wallet + Telegram stealer: quiet today.
• *`kartyk` red-team engagement**: quiet today.
• tailwind-forms-kit EtherHiding mainnet (wallet 0xa322E5...63e1a): quiet today.
• chinazhangsan.ccwu.cc DoH + PWA_ROUTER service-worker hijack: quiet today.
• bfox-build-utils pip GH-Actions worm: quiet today.
• dotenv-precheck Telegram wallet-mnemonic exfil: quiet today.
• fabric-loader-core/mfahelper/get-power install-time RCE: quiet today.
• zeal-utils/zeal-util-hooks aveliscare canary: quiet today.
• *donutautosellsrc/`aseity` Polygon-C2 pip campaign**: quiet today (day 7 silent).

Registry state

All 11 packages in this sweep are PyPI-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

• OpenSSF campaign slug 2026-10-voxeval (Cluster A - 10 new siblings, 11 cumulative with yesterdays voxeval` seed)
• Common Monero mining pool domains and ports as the likely egress target (*.minexmr.com, *.supportxmr.com, *.nanopool.org, *.moneroocean.stream, *.hashvault.pro, *.c3pool.com; ports 3333/4444/5555/7777) - inferred from the GHSA class, not confirmed by a specific GHSA IOC in the body
• Source SHA-256s per package in Cluster A (listed in the table above)
• echogen@1.0.0 source SHA-256 c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644 (Cluster B - no C2 named in the GHSA body)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, kam193/bad-packages. Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-10-03 12:00 UTC and 2026-10-04 12:00 UTC.

Affected packages (11)

Impact

• *Cluster A - 10 pip `voxcpm/voxel-tts/caoxiltts/infrabench siblings of the 2026-10-voxeval cryptominer campaign (malicious-package, confirmed payload)**: all share the exact OpenSSF campaign slug 2026-10-voxeval and the exact GHSA body text "imitates real activity and instead deploys a coin miner" (CWE-506 Embedded Malicious Code). Each is a lure that masquerades as a legitimate VoxCPM / voice-TTS / speech-synthesis / ML-eval runtime, kit, UI, intel, eval, or benchmark utility - the names piggy-back on the real VoxCPM open-source TTS model (OpenBMB) to collect installs from developers assembling an audio-ML or LLM-eval harness. On pip install the payload mines cryptocurrency on the installers host; no credential theft indicator in the GHSA bodies. Packages, versions and source SHA-256s: voxcpmruntime@0.1.0 (GHSA-m88v-2prv-cxqq, 12f18950a276ca27a304d3053835b0102656168083e7ddf414fffb112cbe01ba), voxcpmui4@0.2.0 (GHSA-ch5r-pf97-q38j, c0f6ddfc6a324d42219bbea8405be17115f83eca0e2d2eecb4e3fe6b6ec3dbde), voxcpmkit@0.1.0 (GHSA-88g5-8rp2-p28f, 92a0735c100233f803adcf4cec20645acbb5f01b1757e8889dfaa631e49dae71), voxcpmintel@0.1.0 (GHSA-89pg-5wh4-xm89, 28ef552864bd4b4558137163734077a2429281647a26868f40d8d735af95c967), voxcpmeval@0.1.0 (GHSA-5r29-p327-w47g, 18746c0b1bc840ee608e3aba81f9e18e4411373b8993d315177e95614fe67b08), voxcpmui3@0.1.0 (GHSA-g2fc-7mrh-v3hg, 5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c), voxcpmtts3@0.1.0/0.1.1/0.1.2 (GHSA-7wrq-444c-xg89, 382411a9cc0ee358dbd8efcf17c5a943fc496fc4f2c86ffdc8f87d7efc43ec2d), voxel-tts@0.5.0/0.5.1 (GHSA-f4gp-56hh-96c7, 59ef2094ba4f759a0f896ff0af35b1fd19442db3cf8212a39fde46d5713c807d), caoxiltts@0.1.0/0.1.1 (GHSA-cxq8-x7f3-hc2x, c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f), infrabench@0.1.0/0.1.1/0.2.0 (GHSA-jf4p-2v4v-8p64, 4abc7154004498e9054ca8ac239acd73ab86815f6029ad5d52e4c883488f4c70). Yesterdays [voxeval@0.4.2-0.4.5 Cluster E](/incident/multi-2026-10-03-ghsa-malware-sweep) was sibling 1 of 12; todays batch is siblings 2 through 11. The voxcpmui3/voxcpmui4 and voxcpmtts3 numbering suggests the operator is iterating published artefacts
• Cluster B - pip echogen generic install-time info-exfil pentest probe (malicious-package, GENERIC-standard-pypi-install-pentest, no corpus siblings): echogen@1.0.0 (GHSA-w6gm-xv6q-cq55, source SHA-256 c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644, OpenSSF campaign GENERIC-standard-pypi-install-pentest, CWE-506). Advisory body: "exfiltrates basic information about the host" (IP addresses, usernames) and "overrides the install command in setup.py to execute malicious code during installation." The GENERIC-standard-pypi-install-pentest slug is OpenSSFs bucket for untargeted install-time info-exfil pentest probes that do not fit a named corpus - these show up weekly, usually as single-package publications from one-off researcher accounts. No linkage to any other today-corpus campaign. Severity medium` within the sweep - no payload beyond the install-time beacon of host IP + username
• Operator continuity check: Todays sweep is almost entirely a continuation of yesterdays voxeval NEW campaign (Cluster A - 10 more siblings than the 1 catalogued yesterday). No new named operators. No fresh npm, Go, or RubyGems advisories in the 2026-10-03 (late) to 2026-10-04 window; the amel10 AWS API Gateway dep-confusion operator and the jexkcode/noverojs PhantomSub Baileys operator both go quiet for a day on this cycle. The spo365-graph AWS Lambda + Secrets Manager pip operator is also quiet today (yesterdays dedh-devops-automation was day 2; today day 3 silent). The Graphalgo Go-module expansion from yesterday is quiet today. Zero kartyk* red-team, sherpy/shortneer, tailwind-forms-kit EtherHiding, chinazhangsan.ccwu.cc, bfox-build-utils, or fabric-loader-core` publications

What to do

1. 1Grep every requirements.txt, Pipfile.lock, poetry.lock, pyproject.toml, and uv.lock for voxcpmruntime, voxcpmui4, voxcpmkit, voxcpmintel, voxcpmeval, voxcpmui3, voxcpmtts3, voxel-tts, caoxiltts, infrabench, and echogen in addition to yesterdays voxeval. Uninstall on hit, wipe .venv/__pycache__`, delete the lockfile, rebuild against a clean cache. All eleven carry confirmed payloads - a hit is a compromise, not a warning
2. 2*For Cluster A (10 pip `voxcpm/voxel-tts/caoxiltts/infrabench 2026-10-voxeval cryptominer siblings)**: uninstall on hit; audit host CPU/GPU utilisation and process trees for cryptocurrency mining pool connections (common Monero/XMR CryptoNight/RandomX pool ports 3333/4444/5555/7777 and known pool domains .minexmr.com, .supportxmr.com, .nanopool.org, .moneroocean.stream, .hashvault.pro, .c3pool.com). Image the host if you cannot rule out running processes - a cryptominer that survived uninstall still consumes CPU and electricity on your bill. Add a lockfile-lint denylist for any voxcpm/voxel-tts publisher that is not OpenBMBs official VoxCPM upstream (the real VoxCPM is a research project; the real audio-TTS packages are typically TTS, coqui-tts, openvoice, not fresh voxcpm* from unknown authors). The campaign is clearly mid-publication - expect 5-10 more siblings per day until it exhausts the operators name list; keep this files denylist pattern in CI through at least 2026-10-11
3. 3For Cluster B (pip echogen generic install-time info-exfil pentest probe): uninstall on hit. The payload is a basic host IP + username beacon during install - no RCE, no persistence - but if pip install echogen ran on a host with any credentials in environment variables or ~/.aws/credentials/~/.ssh//.env reach, rotate those because the setup.py override executes with the installer-users full privileges. If echogen` is a legitimate internal name at your org, hold the public-PyPI name with a placeholder package of the same name
4. 4Keep prior egress blocks in place: Ethereum mainnet RPC endpoints (per 2026-09-30 Cluster A tailwind-forms-kit), Ethereum Sepolia RPC endpoints (per indexed-btree), Arbitrum Sepolia RPC endpoints (per 2026-10-03 Cluster D gogets.dev/btreex + gocommunity.io/orderedbtree), chinazhangsan.ccwu.cc, gist.githubusercontent.com/chinazhangsan999-crypto, api.npoint.io, api.telegram.org (from CI), fabric-npm.gm-service.xyz, www.jsonkeeper.com, github.com/trktgq0wbre1, npm-canary.aveliscare.com, Polygon RPC endpoints, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil at the egress proxy, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook (per 2026-10-03 Cluster A amel10). NEW today: block outbound DNS/HTTPS to the common Monero mining pools above from any CI/build host

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-m88v-2prv-cxqq - pip voxcpmruntime (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-ch5r-pf97-q38j - pip voxcpmui4 (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-88g5-8rp2-p28f - pip voxcpmkit (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-89pg-5wh4-xm89 - pip voxcpmintel (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-5r29-p327-w47g - pip voxcpmeval (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-g2fc-7mrh-v3hg - pip voxcpmui3 (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-7wrq-444c-xg89 - pip voxcpmtts3 (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-f4gp-56hh-96c7 - pip voxel-tts (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-cxq8-x7f3-hc2x - pip caoxiltts (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-jf4p-2v4v-8p64 - pip infrabench (Cluster A - 2026-10-voxeval cryptominer sibling)

  github.com
  GitHub
• GHSA-w6gm-xv6q-cq55 - pip echogen (Cluster B - GENERIC-standard-pypi-install-pentest install-time info-exfil probe)

  github.com
  GitHub
• OpenSSF malicious-packages - caoxiltts MAL-2026-17471

  github.com
  OpenSSF