Live › package › MAL-2026-18432
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pystr-codec | pypi | = 0.1.0; = 0.1.1; = 0.1.2 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting remote commands, attempts spreading using discovered credentials as well as periodically checks if discovered credentials are valid. Once they are invalidated, it performs destructive actions on the local machine. It seems to be part of the Miasma-family worm (also known under testmetest).
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-pystr-codec
Reasons (based on the campaign):
obfuscation
abuses-pth
infostealer
worm
backdoor
persistence
exfiltration-credentials
destructive-actions
This page as .md · .json · in your agent: get_signal("MAL-2026-18432")