{"id":"MAL-2026-15603","kind":"package","aliases":["MAL-2026-15603"],"related":[],"title":"Malicious code in pyservercheck (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859)\nThe package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long run of tab whitespace and a trailing eval(atob('...')) that decodes to a two-stage loader. The decoded loader queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 pair from the tx `to` field, fetches XOR-obfuscated stage-2 code from http://<decoded-ip>:443/0x/cls and /0x/ls, eval()s it, and re-launches it via a detached `spawn('node', ['-e', <code>])`. Execution is wired to two auto-triggers: pyproject.toml overrides setuptools `build_py` and `develop` with pyservercheck._setup_cmd.BuildPy/Develop, whose `run()` calls _run_main_js_now() -> subprocess.run(['node', main.js]) during `pip install` / `pip install -e.`; and BuildPy also writes a `pyservercheck.pth` file containing `import pyservercheck._hooks; pyservercheck._hooks.ensure_once()`, which Python auto-executes at every interpreter startup, invoking run_js() again. The `.main_js_ran` marker is advisory and can be removed to force re-execution. The C2 destination is rotatable by publishing a new Ethereum transaction from the sender address, so the fetched payload is fully attacker-controlled at each run.\n\n## Source: kam193 (4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a)\nPackage embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain. \n\nThe payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-pybitjs\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n\n - abuses-pth\n\n\n - c2-in-blockchain","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pyservercheck","fixed":[],"affected":"= 0.1.0; = 0.1.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-08-31T05:02:04+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-08':292C '-15603':8A,11A '-2':107C '-2026':7A,10A '/0x/ls':112C '/eth,':80C '0xa322e5f3d311d3080e6f0121063e9adc2490ef1a':92C '1rpc.io':79C '1rpc.io/eth,':78C '2026':291C '443/0x/cls':110C '4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a':229C 'abus':309C 'abuses-pth':308C 'address':214C 'advisori':190C 'also':162C 'amazon':26C 'amazon-inspector':25C 'apt/polinrider':279C 'atob':60C 'attack':222C 'attacker-control':221C 'attribut':276C 'auto':133C,174C 'auto-execut':173C 'auto-trigg':132C 'base':235C,295C 'blockchain':266C,314C 'build':138C,246C 'buildpi':161C 'bundl':33C 'c2':201C,312C 'c2-in-blockchain':311C 'call':146C 'campaign':275C,283C,290C,298C 'categori':280C 'clear':285C 'code':2A,108C,242C 'consist':273C 'contain':167C 'control':223C 'd10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859':28C 'decod':62C,70C 'deliv':263C 'destin':202C 'detach':123C 'detail':17C 'develop':141C 'download':237C,300C 'e':126C,159C 'edit':20C 'emb':231C 'embed':270C 'endpoint':76C 'eth-mainnet.public.blastapi.io':83C 'eth.blockscout.com':77C 'eth.drpc.org':81C 'ethereum':74C,209C 'ethereum-rpc.publicnode.com':82C 'eval':59C,113C 'everi':177C,251C 'execut':127C,175C,199C,302C 'extract':93C 'fetch':102C,217C 'field':101C 'file':166C,256C 'follow':48C 'forc':196C 'fulli':220C 'half':40C 'hardcod':90C 'healthcheck':43C 'import':168C 'infosteal':289C 'inspector':27C 'instal':156C,158C 'intent':287C 'interpret':178C 'invok':180C 'ioc':271C 'ip':261C 'ipv4':95C 'js':149C,182C,186C,234C 'js-base':233C 'kam193':228C 'latest':86C 'launch':119C 'lazarus':278C 'like':288C 'line':23C 'loader':68C,71C 'long':51C 'main':148C,185C 'main.js':153C 'mal':6A,9A 'malici':1A,13B,281C,286C,305C 'malwar':236C,307C 'marker':188C 'match':45C 'new':208C 'next':259C 'next-stag':258C 'node':34C,125C,152C 'obfusc':105C,232C,299C 'overrid':136C 'packag':14B,30C,230C,248C 'pair':96C 'payload':218C,268C 'per':15C 'pip':155C,157C 'pth':255C,310C 'public':73C 'publish':206C 'py':139C 'pybitj':293C 'pypi':5A 'pyproject.toml':135C 'pyservercheck':4A,12A 'pyservercheck._hooks':169C 'pyservercheck._hooks.ensure_once':170C 'pyservercheck._setup_cmd.buildpy/develop':143C 'pyservercheck.pth':165C 'pyservercheck/js/main.js':36C 'python':172C,252C 'queri':72C 'ran':187C 're':118C,198C 're-execut':197C 're-launch':117C 'readm':47C 'reason':294C 'remot':239C,304C 'remov':194C 'rotat':204C 'rpc':75C 'run':52C,145C,147C,181C,226C 'script':35C,306C 'sender':91C,213C 'setuptool':137C 'ship':31C 'sourc':16C,24C,227C 'spawn':124C 'stage':67C,106C,240C,260C 'startup':179C,253C 'stub':44C 'subprocess.run':151C 'tab':54C 'top':39C 'trail':58C 'transact':87C,210C 'trigger':134C,244C 'two':66C,131C 'two-stag':65C 'tx':99C 'via':121C,254C,264C 'visibl':38C 'whitespac':55C 'whose':37C,144C 'wire':129C 'write':163C 'xor':104C 'xor-obfusc':103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-31T05:02:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-15603","url":"https://osv.dev/vulnerability/MAL-2026-15603","severity":"critical","published_at":"2026-08-31T05:02:04+00:00","modified_at":"2026-09-09T13:45:04+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}