LWA-2026-5411 confirmed malware

@vosslang/cli-linux-arm64@0.1.1

Malicious code in @vosslang/cli-linux-arm64 (npm)

Analysis

Package @vosslang/cli-linux-arm64@0.1.1 ships a full Python 3.12 runtime (23MB binary + standard library) bundled with pip-installed packages including litellm, cryptography, huggingface_hub, numpy, and tiktoken — totalling 351MB. The postinstall script chmods the Python binary executable. A custom Python module (`voss`) is present at python/lib/python3.12/site-packages/voss/ with a CLI entry point. This platform-specific package acts as a carrier for a Python runtime and dependencies used by the parent @vosslang/cli tool.

analyzed by
Leitwacht
first seen
Jun 15, 2026, 05:53 PM
analyzed
Jun 15, 2026, 05:56 PM

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.