pypi
Malicious ai-perf-toolkit @2.4.2
Vulnerability report · Last retrieved from osv.dev July 30, 2026 at 10:40 PM UTC
OSV ID
MAL-2026-11197
Ecosystem
pypi
Summary
During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-ai-perf-toolkit Reasons (based on the campaign): - cryptominer
Source: kam193 (41d25387636c9b0b89a404304d079c30ad28bda33bb551e551cb9e15a75c00ba)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.