LWA-2026-5411 confirmed malware
@vosslang/cli-linux-arm64@0.1.1
Malicious code in @vosslang/cli-linux-arm64 (npm)
Analysis
Package @vosslang/cli-linux-arm64@0.1.1 ships a full Python 3.12 runtime (23MB binary + standard library) bundled with pip-installed packages including litellm, cryptography, huggingface_hub, numpy, and tiktoken — totalling 351MB. The postinstall script chmods the Python binary executable. A custom Python module (`voss`) is present at python/lib/python3.12/site-packages/voss/ with a CLI entry point. This platform-specific package acts as a carrier for a Python runtime and dependencies used by the parent @vosslang/cli tool.
- analyzed by
- Leitwacht
- first seen
- Jun 15, 2026, 05:53 PM
- analyzed
- Jun 15, 2026, 05:56 PM
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.