MAL-2026-11197

    Dashboard / Malicious Package / MAL-2026-11197

    MAL-2026-11197

    Published: 30 Jul 2026Last Modified: 4 Aug 2026

    Summary: Malicious code in ai-perf-toolkit (PyPI)

    Details: Source: amazon-inspector (0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83) On import, the package's top-level __init__.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 using a hardcoded Monero wallet address, with a pgrep guard to avoid double-launch. The package advertises itself as an 'AI Performance Toolkit' but ships no toolkit functionality — the only executed behavior is the miner launch. Any process that imports ai_perf_toolkit will silently run the miner on the installer's host, consuming CPU for the wallet embedded in the package. Source: kam193 (41d25387636c9b0b89a404304d079c30ad28bda33bb551e551cb9e15a75c00ba) During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-ai-perf-toolkit Reasons (based on the campaign): - cryptominer

    References: https://bad-packages.kam193.eu/pypi/package/ai-perf-toolkit, https://pypi.org/project/ai-perf-toolkit/2.4.2/

    Affected packages

    Package

    Name: ai-perf-toolkit

    Purl: pkg:pypi/ai-perf-toolkit

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.4.2