# MAL-2026-17469: Malicious code in infrabench (PyPI)


- **Type:** Malicious package
- **Package:** `infrabench` (PyPI)
- **Published:** 3 Oct 2026

## What is MAL-2026-17469?

MAL-2026-17469 is a malicious package in infrabench, published on 3 Oct 2026. 

### Official description

The package's public API harness.run(edge=<host>) downloads two sha256-pinned gzipped native binaries ('inference-core.bin.gz' and 'edge-conn.bin.gz') from https://<edge>/files/, chmods them 0755, and spawns them on the installer's host. The caller-supplied edge argument chooses only the delivery CDN; the binary contents are fixed by the author via the pinned hashes. The surrounding Python code emits a synthetic, deterministic progress trace (fabricated step/loss/tok-s lines) rather than real benchmark data, so the advertised 'evaluation harness' purpose does not match the behavior of the fetched code. The JSON configuration passed to the 'inference-core' binary — pools:[{url,user,pass:'vox',keepalive,tls}], cpu:{enabled,threads,mem-locked}, cache-budget, log-period, autosave — matches the xmrig-family mining-pool client schema rather than any inference or benchmarking worker schema, and the second binary (~19MB) is invoked as 'access tcp --hostname <host> --url 127.0.0.1:<port>', the Cloudflare cloudflared access-tunnel CLI shape used to reach a pool endpoint behind a tunnel. A _hb() routine additionally POSTs run id, state, and up to 4000 characters of exception traceback to https://<edge>/hb as an operator heartbeat/control-plane check-in. Installing and invoking the harness causes the installer's machine to execute author-controlled native code and donate CPU to an operator-controlled mining pool under a fake benchmarking cover story.

The package imitates real activity and instead deploys a coin miner.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voxeval

Reasons (based on the campaign):

 - cryptominer

## What should I do about MAL-2026-17469?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17469 is a malicious package: infrabench (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17469/ (Markdown: https://insights.sbomify.com/MAL-2026-17469/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17469

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17469/
Summaries are generated and may contain mistakes; the official description above is the record.