{"id":"MAL-2026-14545","kind":"package","aliases":["MAL-2026-14545"],"related":[],"title":"Malicious code in pybitjs (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5)\nThe package's setuptools cmdclasses (BuildPy, Develop) invoke `node pybitjs/js/main.js` during `pip install`, and write a `pybitjs.pth` file containing `import pybitjs._autorun; pybitjs._autorun.run_main_js_once()` so the same Node.js payload is re-executed on every subsequent Python interpreter startup. The bundled `pybitjs/js/main.js` is heavily string-array obfuscated (obfuscator.io style `_0x240a` / `_0x4963`) and implements an EtherHiding-style C2: it queries Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, etherscan-like API) for transactions involving the hardcoded address `0xa322E5f3...`, extracts an IPv4 from the transaction data, HTTP-fetches an XOR-encrypted blob from that IP, decrypts it, and passes the decrypted content to `eval(...)` and to `spawn('node', ['-e', <payload>], {detached:true}).unref()`. Because the C2 host is dereferenced from an on-chain transaction, the destination is attacker-mutable, and installing or launching Python with this package present causes arbitrary attacker-controlled code to be fetched and executed on the installer's host.\n\n## Source: kam193 (8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8)\nPackage embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain. \n\nThe payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-pybitjs\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n\n - abuses-pth\n\n\n - c2-in-blockchain","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pybitjs","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-08-26T19:21:41+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':250C '-14545':8A,11A '-2026':7A,10A '0x240a':77C '0x4963':78C '0xa322e5f3':106C '2026':249C '611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5':28C '8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8':187C 'abus':267C 'abuses-pth':266C 'address':105C 'amazon':26C 'amazon-inspector':25C 'api':99C 'apt/polinrider':237C 'arbitrari':170C 'array':73C 'attack':158C,172C 'attacker-control':171C 'attacker-mut':157C 'attribut':234C 'base':193C,253C 'blob':121C 'blockchain':224C,272C 'blockscout':95C 'build':204C 'buildpi':34C 'bundl':67C 'c2':85C,144C,270C 'c2-in-blockchain':269C 'campaign':233C,241C,248C,256C 'categori':238C 'caus':169C 'chain':152C 'clear':243C 'cmdclass':33C 'code':2A,174C,200C 'consist':231C 'contain':47C 'content':131C 'control':173C 'data':113C 'decrypt':125C,130C 'deliv':221C 'dereferenc':147C 'destin':155C 'detach':139C 'detail':17C 'develop':35C 'download':195C,258C 'drpc.org':93C 'e':138C 'edit':20C 'emb':189C 'embed':228C 'encrypt':120C 'endpoint':92C 'ethereum':88C 'etherhid':83C 'etherhiding-styl':82C 'etherscan':97C 'etherscan-lik':96C 'eval':133C 'everi':61C,209C 'execut':59C,179C,260C 'extract':107C 'fetch':116C,177C 'file':46C,214C 'hardcod':104C 'heavili':70C 'host':145C,184C 'http':115C 'http-fetch':114C 'implement':80C 'import':48C 'infosteal':247C 'inspector':27C 'instal':41C,161C,182C 'intent':245C 'interpret':64C 'invok':36C 'involv':102C 'ioc':229C 'ip':124C,219C 'ipv4':109C 'js':192C 'js-base':191C 'json':90C 'json-rpc':89C 'kam193':186C 'launch':163C 'lazarus':236C 'like':98C,246C 'line':23C 'mal':6A,9A 'malici':1A,13B,239C,244C,263C 'malwar':194C,265C 'mutabl':159C 'next':217C 'next-stag':216C 'node':37C,137C 'node.js':54C 'obfusc':74C,190C,257C 'obfuscator.io':75C 'on-chain':150C 'packag':14B,30C,167C,188C,206C 'pass':128C 'payload':55C,226C 'per':15C 'pip':40C 'present':168C 'pth':213C,268C 'publicnode.com':94C 'pybitj':4A,251C 'pybitjs':12A 'pybitjs._autorun':49C 'pybitjs._autorun.run_main_js_once':50C 'pybitjs.pth':45C 'pybitjs/js/main.js':38C,68C 'pypi':5A 'python':63C,164C,210C 'queri':87C 're':58C 're-execut':57C 'reason':252C 'remot':197C,262C 'rpc':91C 'script':264C 'setuptool':32C 'sourc':16C,24C,185C 'spawn':136C 'stage':198C,218C 'startup':65C,211C 'string':72C 'string-array':71C 'style':76C,84C 'subsequ':62C 'transact':101C,112C,153C 'trigger':202C 'true':140C 'unref':141C 'via':212C,222C 'write':43C 'xor':119C 'xor-encrypt':118C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-26T19:21:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-14545","url":"https://osv.dev/vulnerability/MAL-2026-14545","severity":"critical","published_at":"2026-08-26T19:21:41+00:00","modified_at":"2026-09-09T13:45:04+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}