{"answers":{"affected":"1 open source package ship an affected version, including vantrala.","exploited":"There is no known exploitation of MAL-2026-10867 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10867 is a malicious package in vantrala, published on 20 Jul 2026."},"fix_prompt":"MAL-2026-10867 is a malicious package: vantrala (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10867/ (Markdown: https://insights.sbomify.com/MAL-2026-10867/index.md)","id":"MAL-2026-10867","markdown":"https://insights.sbomify.com/MAL-2026-10867/index.md","name":"MAL-2026-10867","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as a 'Python wrapper for the bundled kimichat runtime' but the bundled 32MB ELF at src/vantrala/resources/kimichat is ForgeMiner/1.4.1, a GPU cryptocurrency miner (kawpow/xelis/cryptix). The console_script 'vantrala-run' (core.py run() -\u003e subprocess.run(['bash', launcher,...])) invokes start.sh, which sets FORGE_WALLET to a hardcoded author Pearl-coin address (prl1p2jan4dvkdfkt5r3pra7z96axrxjyjcgat9w7ldetlcy9wffm569sc9ux2t) and FORGE_POOL to 45.151.62.119:3361, then execs the miner. Binary strings confirm the payload identity (ForgeMiner/1.4.1, FORGE_DEVFEE_PCT, mining.authorize, mining.set_difficulty, xelis_sm*.cubin, kawpow). The package name, description, README, and the renaming of the miner binary to 'kimichat' (a chatbot name) function as a cover story; mining is never disclosed. When a user runs the advertised entry point, their compute, electricity, and hardware wear are silently applied to the author's mining wallet, with a developer-fee skim (FORGE_DEVFEE_PCT) also present.\n\nIn this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-07-kimichat\n\nReasons (based on the campaign):\n\n - cryptominer","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in vantrala (PyPI)","id":"MAL-2026-10867","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"vantrala","purl":"pkg:pypi/vantrala","source":"MAL-2026-10867"}],"products":null,"published":"2026-07-20","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10867/"}