MAL-2026-11197 Malicious code in ai-perf-toolkit (PyPI)
- Package
- ai-perf-toolkit
- Registry
- PyPI
What is MAL-2026-11197?
MAL-2026-11197 is a malicious package in ai-perf-toolkit, published on 30 Jul 2026.
Official description
On import, the package's top-level init.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 using a hardcoded Monero wallet address, with a pgrep guard to avoid double-launch. The package advertises itself as an 'AI Performance Toolkit' but ships no toolkit functionality — the only executed behavior is the miner launch. Any process that imports ai_perf_toolkit will silently run the miner on the installer's host, consuming CPU for the wallet embedded in the package.
During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-ai-perf-toolkit
Reasons (based on the campaign):
- cryptominer
What should I do about MAL-2026-11197?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.