MAL-2026-10867 Malicious code in vantrala (PyPI)

The package presents itself as a 'Python wrapper for the bundled kimichat runtime' but the bundled 32MB ELF at src/vantrala/resources/kimichat is ForgeMiner/1.4.1, a GPU cryptocurrency miner (kawpow/xelis/cryptix). The console_script 'vantrala-run' (core.py run() -> subprocess.run(['bash', launcher,…])) invokes start.sh, which sets FORGE_WALLET to a hardcoded author Pearl-coin address (prl1p2jan4dvkdfkt5r3pra7z96axrxjyjcgat9w7ldetlcy9wffm569sc9ux2t) and FORGE_POOL to 45.151.62.119:3361, then execs the miner. Binary strings confirm the payload identity (ForgeMiner/1.4.1, FORGE_DEVFEE_PCT, mining.authorize, mining.set_difficulty, xelis_sm*.cubin, kawpow). The package name, description, README, and the renaming of the miner binary to 'kimichat' (a chatbot name) function as a cover story; mining is never disclosed. When a user runs the advertised entry point, their compute, electricity, and hardware wear are silently applied to the author's mining wallet, with a developer-fee skim (FORGE_DEVFEE_PCT) also present.

In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-kimichat

Reasons (based on the campaign):

• cryptominer