ai-perf-toolkit

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83)
On import, the package's top-level __init__.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 using a hardcoded Monero wallet address, with a pgrep guard to avoid double-launch. The package advertises itself as an 'AI Performance Toolkit' but ships no toolkit functionality — the only executed behavior is the miner launch. Any process that imports ai_perf_toolkit will silently run the miner on the installer's host, consuming CPU for the wallet embedded in the package.

## Source: kam193 (41d25387636c9b0b89a404304d079c30ad28bda33bb551e551cb9e15a75c00ba)
During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-ai-perf-toolkit


Reasons (based on the campaign):


 - cryptominer

Compromised versions (1)

• 2.4.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.