# GitHub Advisory malware sweep - 2026-10-03 (late) + 2026-10-04 (10 pip `voxcpm*`/`voxel-tts`/`caoxiltts`/`infrabench` siblings of the `2026-10-voxeval` cryptominer campaign - continuation of yesterday`s `voxeval` NEW campaign entry, same OpenSSF campaign slug, CWE-506 "imitates real activity and instead deploys a coin miner"; 1 pip `echogen` generic install-time info-exfil pentest probe with no corpus siblings)

> GHSA 2026-10-03 (late): 11 new pip advisories. Cluster A - 10 `voxcpm*`/`voxel-tts`/`caoxiltts`/`infrabench` siblings of yesterday`s `2026-10-voxeval` cryptominer campaign (yesterday`s `voxeval` was sibling 1 of 12). Cluster B - 1 generic install-time info-exfil pentest probe `echogen`. No new npm, Go, or RubyGems advisories in this 24h window.

- Published: 2026-10-04
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 11 packages, 17 compromised versions
- Tags: infostealer, obfuscation, typosquat, credential-theft
- Also known as: 2026-10-04 GHSA pip sweep, 10 pip voxcpm/voxel-tts/caoxiltts/infrabench 2026-10-voxeval cryptominer siblings, echogen GENERIC-standard-pypi-install-pentest install-time info-exfil probe
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, kam193/bad-packages
- Incident ID: multi-2026-10-04-ghsa-malware-sweep

## Affected packages (11)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [caoxiltts](https://dependencywatch.io/package/pypi/caoxiltts) | PyPI | 0.1.0, 0.1.1 |
| [echogen](https://dependencywatch.io/package/pypi/echogen) | PyPI | 1.0.0 |
| [infrabench](https://dependencywatch.io/package/pypi/infrabench) | PyPI | 0.1.0, 0.1.1, 0.2.0 |
| [voxcpmeval](https://dependencywatch.io/package/pypi/voxcpmeval) | PyPI | 0.1.0 |
| [voxcpmintel](https://dependencywatch.io/package/pypi/voxcpmintel) | PyPI | 0.1.0 |
| [voxcpmkit](https://dependencywatch.io/package/pypi/voxcpmkit) | PyPI | 0.1.0 |
| [voxcpmruntime](https://dependencywatch.io/package/pypi/voxcpmruntime) | PyPI | 0.1.0 |
| [voxcpmtts3](https://dependencywatch.io/package/pypi/voxcpmtts3) | PyPI | 0.1.0, 0.1.1, 0.1.2 |
| [voxcpmui3](https://dependencywatch.io/package/pypi/voxcpmui3) | PyPI | 0.1.0 |
| [voxcpmui4](https://dependencywatch.io/package/pypi/voxcpmui4) | PyPI | 0.2.0 |
| [voxel-tts](https://dependencywatch.io/package/pypi/voxel-tts) | PyPI | 0.5.0, 0.5.1 |

## What happened

Between roughly 2026-10-03 12:00 UTC and 2026-10-04 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspector`s IN-MAL feed, and `kam193/bad-packages`) published 11 new malware advisories, all in the pip ecosystem. The defensively notable shape of today`s window: a 10-package mass expansion of yesterday`s `voxeval` cryptominer campaign (`2026-10-voxeval`), plus one unrelated generic install-time info-exfil pentest probe. No new npm, Go, or RubyGems advisories in this window.

## Cluster A - 10 pip `voxcpm*`/`voxel-tts`/`caoxiltts`/`infrabench` `2026-10-voxeval` cryptominer siblings

Ten pip packages co-published on 2026-10-03 UTC, batched into GHSA on 2026-10-03 (late window after yesterday`s ingest ran at 06:26 UTC):

| Package | Versions | GHSA | Source SHA-256 |
|---|---|---|---|
| `voxcpmruntime` | 0.1.0 | GHSA-m88v-2prv-cxqq | `12f18950a276ca27a304d3053835b0102656168083e7ddf414fffb112cbe01ba` |
| `voxcpmui4` | 0.2.0 | GHSA-ch5r-pf97-q38j | `c0f6ddfc6a324d42219bbea8405be17115f83eca0e2d2eecb4e3fe6b6ec3dbde` |
| `voxcpmkit` | 0.1.0 | GHSA-88g5-8rp2-p28f | `92a0735c100233f803adcf4cec20645acbb5f01b1757e8889dfaa631e49dae71` |
| `voxcpmintel` | 0.1.0 | GHSA-89pg-5wh4-xm89 | `28ef552864bd4b4558137163734077a2429281647a26868f40d8d735af95c967` |
| `voxcpmeval` | 0.1.0 | GHSA-5r29-p327-w47g | `18746c0b1bc840ee608e3aba81f9e18e4411373b8993d315177e95614fe67b08` |
| `voxcpmui3` | 0.1.0 | GHSA-g2fc-7mrh-v3hg | `5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c` |
| `voxcpmtts3` | 0.1.0, 0.1.1, 0.1.2 | GHSA-7wrq-444c-xg89 | `382411a9cc0ee358dbd8efcf17c5a943fc496fc4f2c86ffdc8f87d7efc43ec2d` |
| `voxel-tts` | 0.5.0, 0.5.1 | GHSA-f4gp-56hh-96c7 | `59ef2094ba4f759a0f896ff0af35b1fd19442db3cf8212a39fde46d5713c807d` |
| `caoxiltts` | 0.1.0, 0.1.1 | GHSA-cxq8-x7f3-hc2x | `c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f` |
| `infrabench` | 0.1.0, 0.1.1, 0.2.0 | GHSA-jf4p-2v4v-8p64 | `4abc7154004498e9054ca8ac239acd73ab86815f6029ad5d52e4c883488f4c70` |

**The primitive.** All ten carry the identical GHSA body text "imitates real activity and instead deploys a coin miner" and are tagged into the same OpenSSF campaign slug `2026-10-voxeval` first used by [yesterday`s `voxeval@0.4.2-0.4.5` Cluster E](https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep). Each package is a lure: on `pip install` it reports a plausible speech/eval/benchmark init-sequence while the real payload is a coin miner that persists for as long as the Python environment is active.

**Target shape.** The names deliberately piggy-back on the real `VoxCPM` open-source TTS model (OpenBMB, 2024-2025) and on adjacent audio-ML / LLM-eval naming:

- `voxcpmruntime`, `voxcpmkit`, `voxcpmintel`, `voxcpmui3`, `voxcpmui4`, `voxcpmeval`, `voxcpmtts3` - all read as "a utility for working with VoxCPM" and a developer assembling a VoxCPM eval harness would plausibly `pip install` any of them.
- `voxel-tts` - looks like a different TTS model (voxel-based synthesis) rather than VoxCPM; a sibling lure.
- `caoxiltts` - unclear naming (possibly a misspelling / transliteration of a Chinese TTS brand); still slotted into the campaign.
- `infrabench` - sounds like an infrastructure benchmark harness; sits oddly in a TTS-themed campaign, suggests the operator is also probing adjacent ML-ops naming.

**Operator continuity.** The campaign slug `2026-10-voxeval` was first used by yesterday`s `voxeval` entry. Today`s 10 siblings are the mass-publication wave that follows the single-sample seeding. Expect more siblings in the next 24-72 hours.

Classify as `malicious-package` for each. Severity `high` within the sweep (confirmed malicious payload, limited reach - only affects whoever installs the lure).

## Cluster B - pip `echogen` generic install-time info-exfil pentest probe

`echogen@1.0.0` (GHSA-w6gm-xv6q-cq55, source SHA-256 `c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644`, OpenSSF campaign `GENERIC-standard-pypi-install-pentest`, CWE-506).

Advisory body: "exfiltrates basic information about the host" such as IP addresses and usernames during installation, and "overrides the install command in setup.py to execute malicious code during installation."

The `GENERIC-standard-pypi-install-pentest` OpenSSF slug is the collector bucket for untargeted install-time info-exfil pentest probes that do not fit a named corpus. These generally come from one-off researcher accounts testing their reach against public-PyPI. No linkage to any other today-corpus campaign; no corpus siblings in the catalogue.

Classify as `malicious-package` (install-time beacon is confirmed malicious regardless of researcher intent). Severity `medium` within the sweep.

## Operator continuity check

- **`voxeval` cryptominer campaign (`2026-10-voxeval`)**: on day 2 of visible publications in this corpus (Cluster A, 10 new siblings today). Yesterday`s `voxeval` was sibling 1 of 12. The naming reaches across VoxCPM, voxel-TTS, generic bench, and transliteration-style names - the operator is testing which fake-brand variants grab installs.
- **`echogen` generic info-exfil probe**: NEW to corpus today (Cluster B), single-package, no corpus siblings.
- **`amel10` AWS API Gateway dep-confusion operator (Amazon/Alexa internal names)**: quiet today - yesterday`s six-package burst (Cluster A of [2026-10-03 sweep](https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep)) is day 1 silent in the Oct 3 (late) + Oct 4 window.
- **`jexkcode`/`noverojs`/`xayz` PhantomSub Baileys operator**: quiet today after the 5-sibling batch yesterday.
- **`spo365-graph` AWS Lambda + Secrets Manager pip operator**: quiet today (yesterday`s `dedh-devops-automation` was day 2; today day 3 silent).
- **`Graphalgo` Go-module expansion**: quiet today after yesterday`s first-ever Go samples.
- **`friendly-greeting-tools`/`friendly-tools` Snowflake credential-theft family (`pkusinski-external` S3)**: quiet today.
- **`sherpy`/`shortneer` pip Chrome-wallet + Telegram stealer**: quiet today.
- **`kartyk*` red-team engagement**: quiet today.
- **`tailwind-forms-kit` EtherHiding mainnet (wallet `0xa322E5...63e1a`)**: quiet today.
- **`chinazhangsan.ccwu.cc` DoH + PWA_ROUTER service-worker hijack**: quiet today.
- **`bfox-build-utils` pip GH-Actions worm**: quiet today.
- **`dotenv-precheck` Telegram wallet-mnemonic exfil**: quiet today.
- **`fabric-loader-core`/`mfahelper`/`get-power` install-time RCE**: quiet today.
- **`zeal-utils`/`zeal-util-hooks` aveliscare canary**: quiet today.
- **`donutautosellsrc`/`aseity*` Polygon-C2 pip campaign**: quiet today (day 7 silent).

## Registry state

All 11 packages in this sweep are PyPI-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

- OpenSSF campaign slug `2026-10-voxeval` (Cluster A - 10 new siblings, 11 cumulative with yesterday`s `voxeval` seed)
- Common Monero mining pool domains and ports as the likely egress target (`*.minexmr.com`, `*.supportxmr.com`, `*.nanopool.org`, `*.moneroocean.stream`, `*.hashvault.pro`, `*.c3pool.com`; ports 3333/4444/5555/7777) - inferred from the GHSA class, not confirmed by a specific GHSA IOC in the body
- Source SHA-256s per package in Cluster A (listed in the table above)
- `echogen@1.0.0` source SHA-256 `c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644` (Cluster B - no C2 named in the GHSA body)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `kam193/bad-packages`. Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-10-03 12:00 UTC and 2026-10-04 12:00 UTC.

## Impact

- **Cluster A - 10 pip `voxcpm*`/`voxel-tts`/`caoxiltts`/`infrabench` siblings of the `2026-10-voxeval` cryptominer campaign (malicious-package, confirmed payload)**: all share the exact OpenSSF campaign slug `2026-10-voxeval` and the exact GHSA body text "imitates real activity and instead deploys a coin miner" (CWE-506 Embedded Malicious Code). Each is a lure that masquerades as a legitimate VoxCPM / voice-TTS / speech-synthesis / ML-eval runtime, kit, UI, intel, eval, or benchmark utility - the names piggy-back on the real `VoxCPM` open-source TTS model (OpenBMB) to collect installs from developers assembling an audio-ML or LLM-eval harness. On `pip install` the payload mines cryptocurrency on the installer`s host; no credential theft indicator in the GHSA bodies. Packages, versions and source SHA-256s: `voxcpmruntime@0.1.0` (GHSA-m88v-2prv-cxqq, `12f18950a276ca27a304d3053835b0102656168083e7ddf414fffb112cbe01ba`), `voxcpmui4@0.2.0` (GHSA-ch5r-pf97-q38j, `c0f6ddfc6a324d42219bbea8405be17115f83eca0e2d2eecb4e3fe6b6ec3dbde`), `voxcpmkit@0.1.0` (GHSA-88g5-8rp2-p28f, `92a0735c100233f803adcf4cec20645acbb5f01b1757e8889dfaa631e49dae71`), `voxcpmintel@0.1.0` (GHSA-89pg-5wh4-xm89, `28ef552864bd4b4558137163734077a2429281647a26868f40d8d735af95c967`), `voxcpmeval@0.1.0` (GHSA-5r29-p327-w47g, `18746c0b1bc840ee608e3aba81f9e18e4411373b8993d315177e95614fe67b08`), `voxcpmui3@0.1.0` (GHSA-g2fc-7mrh-v3hg, `5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c`), `voxcpmtts3@0.1.0`/`0.1.1`/`0.1.2` (GHSA-7wrq-444c-xg89, `382411a9cc0ee358dbd8efcf17c5a943fc496fc4f2c86ffdc8f87d7efc43ec2d`), `voxel-tts@0.5.0`/`0.5.1` (GHSA-f4gp-56hh-96c7, `59ef2094ba4f759a0f896ff0af35b1fd19442db3cf8212a39fde46d5713c807d`), `caoxiltts@0.1.0`/`0.1.1` (GHSA-cxq8-x7f3-hc2x, `c0d27d780e356c6ae75dedaa144f2064476e275a02f801a1d56897a3a9d1930f`), `infrabench@0.1.0`/`0.1.1`/`0.2.0` (GHSA-jf4p-2v4v-8p64, `4abc7154004498e9054ca8ac239acd73ab86815f6029ad5d52e4c883488f4c70`). Yesterday`s [`voxeval@0.4.2-0.4.5` Cluster E](https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep) was sibling 1 of 12; today`s batch is siblings 2 through 11. The `voxcpmui3`/`voxcpmui4` and `voxcpmtts3` numbering suggests the operator is iterating published artefacts
- **Cluster B - pip `echogen` generic install-time info-exfil pentest probe (malicious-package, GENERIC-standard-pypi-install-pentest, no corpus siblings)**: `echogen@1.0.0` (GHSA-w6gm-xv6q-cq55, source SHA-256 `c38ef1a445f502de507bc9e58f66539c816eb765a086e14631bd164bc501a644`, OpenSSF campaign `GENERIC-standard-pypi-install-pentest`, CWE-506). Advisory body: "exfiltrates basic information about the host" (IP addresses, usernames) and "overrides the install command in setup.py to execute malicious code during installation." The `GENERIC-standard-pypi-install-pentest` slug is OpenSSF`s bucket for untargeted install-time info-exfil pentest probes that do not fit a named corpus - these show up weekly, usually as single-package publications from one-off researcher accounts. No linkage to any other today-corpus campaign. Severity `medium` within the sweep - no payload beyond the install-time beacon of host IP + username
- **Operator continuity check**: Today`s sweep is almost entirely a continuation of yesterday`s `voxeval` NEW campaign (Cluster A - 10 more siblings than the 1 catalogued yesterday). No new named operators. No fresh npm, Go, or RubyGems advisories in the 2026-10-03 (late) to 2026-10-04 window; the `amel10` AWS API Gateway dep-confusion operator and the `jexkcode`/`noverojs` PhantomSub Baileys operator both go quiet for a day on this cycle. The `spo365-graph` AWS Lambda + Secrets Manager pip operator is also quiet today (yesterday`s `dedh-devops-automation` was day 2; today day 3 silent). The `Graphalgo` Go-module expansion from yesterday is quiet today. Zero `kartyk*` red-team, `sherpy`/`shortneer`, `tailwind-forms-kit` EtherHiding, `chinazhangsan.ccwu.cc`, `bfox-build-utils`, or `fabric-loader-core` publications

## What to do

1. Grep every `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `pyproject.toml`, and `uv.lock` for `voxcpmruntime`, `voxcpmui4`, `voxcpmkit`, `voxcpmintel`, `voxcpmeval`, `voxcpmui3`, `voxcpmtts3`, `voxel-tts`, `caoxiltts`, `infrabench`, and `echogen` in addition to yesterday`s `voxeval`. Uninstall on hit, wipe `.venv`/`__pycache__`, delete the lockfile, rebuild against a clean cache. All eleven carry confirmed payloads - a hit is a compromise, not a warning
2. **For Cluster A (10 pip `voxcpm*`/`voxel-tts`/`caoxiltts`/`infrabench` `2026-10-voxeval` cryptominer siblings)**: uninstall on hit; audit host CPU/GPU utilisation and process trees for cryptocurrency mining pool connections (common Monero/XMR CryptoNight/RandomX pool ports 3333/4444/5555/7777 and known pool domains `*.minexmr.com`, `*.supportxmr.com`, `*.nanopool.org`, `*.moneroocean.stream`, `*.hashvault.pro`, `*.c3pool.com`). Image the host if you cannot rule out running processes - a cryptominer that survived uninstall still consumes CPU and electricity on your bill. Add a lockfile-lint denylist for any `voxcpm*`/`voxel-tts*` publisher that is not OpenBMB`s official VoxCPM upstream (the real VoxCPM is a research project; the real audio-TTS packages are typically `TTS`, `coqui-tts`, `openvoice`, not fresh `voxcpm*` from unknown authors). The campaign is clearly mid-publication - expect 5-10 more siblings per day until it exhausts the operator`s name list; keep this file`s denylist pattern in CI through at least 2026-10-11
3. **For Cluster B (pip `echogen` generic install-time info-exfil pentest probe)**: uninstall on hit. The payload is a basic host IP + username beacon during install - no RCE, no persistence - but if `pip install echogen` ran on a host with any credentials in environment variables or `~/.aws/credentials`/`~/.ssh/`/`.env` reach, rotate those because the setup.py override executes with the installer-user`s full privileges. If `echogen` is a legitimate internal name at your org, hold the public-PyPI name with a placeholder package of the same name
4. Keep prior egress blocks in place: Ethereum mainnet RPC endpoints (per 2026-09-30 Cluster A `tailwind-forms-kit`), Ethereum Sepolia RPC endpoints (per [`indexed-btree`](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding)), Arbitrum Sepolia RPC endpoints (per 2026-10-03 Cluster D `gogets.dev/btreex` + `gocommunity.io/orderedbtree`), `chinazhangsan.ccwu.cc`, `gist.githubusercontent.com/chinazhangsan999-crypto`, `api.npoint.io`, `api.telegram.org` (from CI), `fabric-npm.gm-service.xyz`, `www.jsonkeeper.com`, `github.com/trktgq0wbre1`, `npm-canary.aveliscare.com`, Polygon RPC endpoints, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil at the egress proxy, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook` (per 2026-10-03 Cluster A `amel10`). NEW today: block outbound DNS/HTTPS to the common Monero mining pools above from any CI/build host

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-m88v-2prv-cxqq - pip voxcpmruntime (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-m88v-2prv-cxqq) - GitHub
- [GHSA-ch5r-pf97-q38j - pip voxcpmui4 (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-ch5r-pf97-q38j) - GitHub
- [GHSA-88g5-8rp2-p28f - pip voxcpmkit (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-88g5-8rp2-p28f) - GitHub
- [GHSA-89pg-5wh4-xm89 - pip voxcpmintel (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-89pg-5wh4-xm89) - GitHub
- [GHSA-5r29-p327-w47g - pip voxcpmeval (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-5r29-p327-w47g) - GitHub
- [GHSA-g2fc-7mrh-v3hg - pip voxcpmui3 (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-g2fc-7mrh-v3hg) - GitHub
- [GHSA-7wrq-444c-xg89 - pip voxcpmtts3 (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-7wrq-444c-xg89) - GitHub
- [GHSA-f4gp-56hh-96c7 - pip voxel-tts (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-f4gp-56hh-96c7) - GitHub
- [GHSA-cxq8-x7f3-hc2x - pip caoxiltts (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-cxq8-x7f3-hc2x) - GitHub
- [GHSA-jf4p-2v4v-8p64 - pip infrabench (Cluster A - 2026-10-voxeval cryptominer sibling)](https://github.com/advisories/GHSA-jf4p-2v4v-8p64) - GitHub
- [GHSA-w6gm-xv6q-cq55 - pip echogen (Cluster B - GENERIC-standard-pypi-install-pentest install-time info-exfil probe)](https://github.com/advisories/GHSA-w6gm-xv6q-cq55) - GitHub
- [OpenSSF malicious-packages - caoxiltts MAL-2026-17471](https://github.com/ossf/malicious-packages/blob/84601d15df937f4868c23b42f84bd6920f81132a/osv/malicious/pypi/caoxiltts/MAL-2026-17471.json) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-04-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-04-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).