If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (0fa8502570fe8566174dd7979e56a999f3ea7d6bf4f7f5a4f9f6ee579df96b83)
On import, the package's top-level __init__.py starts a background daemon thread that spawns xmrig via subprocess.Popen against pool.minexmr.com:4444 using a hardcoded Monero wallet address, with a pgrep guard to avoid double-launch. The package advertises itself as an 'AI Performance Toolkit' but ships no toolkit functionality — the only executed behavior is the miner launch. Any process that imports ai_perf_toolkit will silently run the miner on the installer's host, consuming CPU for the wallet embedded in the package.
Source: kam193 (41d25387636c9b0b89a404304d079c30ad28bda33bb551e551cb9e15a75c00ba)
During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-07-ai-perf-toolkit
Reasons (based on the campaign):
- cryptominer