{"id":"MAL-2026-14545","title":"Malicious code in pybitjs (PyPI)","summary":"Malicious code in pybitjs (PyPI)","severity":"critical","exploited":true,"vendor":"pybitjs","product":"pybitjs","ecosystem":"pip","affected":["pybitjs"],"published":"2026-08-26","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:45:04.553131389Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-14545","references":[{"url":"https://github.com/stamparm/maltrail/blob/12360952bc81865dc973e33e5033cea6e1fcc342/trails/static/malware/apt_lazarus.txt#L7414"},{"url":"https://etherscan.io/address/0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a"},{"url":"https://bad-packages.kam193.eu/pypi/package/pybitjs"},{"url":"https://pypi.org/project/pybitjs/0.1.0/"},{"url":"https://blog.deception.pro/blog/hok-dprk-polinrider-sep-2026"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-08-27T19:27:45.889Z","slug":"MAL-2026-14545","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5)\nThe package's setuptools cmdclasses (BuildPy, Develop) invoke `node pybitjs/js/main.js` during `pip install`, and write a `pybitjs.pth` file containing `import pybitjs._autorun; pybitjs._autorun.run_main_js_once()` so the same Node.js payload is re-executed on every subsequent Python interpreter startup. The bundled `pybitjs/js/main.js` is heavily string-array obfuscated (obfuscator.io style `_0x240a` / `_0x4963`) and implements an EtherHiding-style C2: it queries Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, etherscan-like API) for transactions involving the hardcoded address `0xa322E5f3...`, extracts an IPv4 from the transaction data, HTTP-fetches an XOR-encrypted blob from that IP, decrypts it, and passes the decrypted content to `eval(...)` and to `spawn('node', ['-e', <payload>], {detached:true}).unref()`. Because the C2 host is dereferenced from an on-chain transaction, the destination is attacker-mutable, and installing or launching Python with this package present causes arbitrary attacker-controlled code to be fetched and executed on the installer's host.\n\n## Source: kam193 (8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8)\nPackage embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain. \n\nThe payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-pybitjs\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n\n - abuses-pth\n\n\n - c2-in-blockchain\n\n\n## Affected packages\n\n- `pybitjs`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[{"seq":202643,"id":"MAL-2026-14545","ts":1789400122563,"field":"exploited","old":"false","new":"true"},{"seq":202642,"id":"MAL-2026-14545","ts":1789400122563,"field":"severity","old":"none","new":"critical"},{"seq":201370,"id":"MAL-2026-14545","ts":1789397624699,"field":"exploited","old":"true","new":"false"},{"seq":201369,"id":"MAL-2026-14545","ts":1789397624699,"field":"severity","old":"critical","new":"none"},{"seq":200063,"id":"MAL-2026-14545","ts":1789395588321,"field":"exploited","old":"false","new":"true"},{"seq":200062,"id":"MAL-2026-14545","ts":1789395588321,"field":"severity","old":"none","new":"critical"},{"seq":199300,"id":"MAL-2026-14545","ts":1789392265921,"field":"exploited","old":"true","new":"false"},{"seq":199299,"id":"MAL-2026-14545","ts":1789392265921,"field":"severity","old":"critical","new":"none"},{"seq":197633,"id":"MAL-2026-14545","ts":1789384307471,"field":"exploited","old":"false","new":"true"},{"seq":197632,"id":"MAL-2026-14545","ts":1789384307471,"field":"severity","old":"none","new":"critical"},{"seq":196907,"id":"MAL-2026-14545","ts":1789383784869,"field":"exploited","old":"true","new":"false"},{"seq":196906,"id":"MAL-2026-14545","ts":1789383784869,"field":"severity","old":"critical","new":"none"},{"seq":195811,"id":"MAL-2026-14545","ts":1789380596220,"field":"exploited","old":"false","new":"true"},{"seq":195810,"id":"MAL-2026-14545","ts":1789380596220,"field":"severity","old":"none","new":"critical"},{"seq":194762,"id":"MAL-2026-14545","ts":1789378793523,"field":"exploited","old":"true","new":"false"},{"seq":194761,"id":"MAL-2026-14545","ts":1789378793523,"field":"severity","old":"critical","new":"none"},{"seq":193549,"id":"MAL-2026-14545","ts":1789376560652,"field":"exploited","old":"false","new":"true"},{"seq":193548,"id":"MAL-2026-14545","ts":1789376560652,"field":"severity","old":"none","new":"critical"},{"seq":192336,"id":"MAL-2026-14545","ts":1789373644301,"field":"exploited","old":"true","new":"false"},{"seq":192335,"id":"MAL-2026-14545","ts":1789373644301,"field":"severity","old":"critical","new":"none"},{"seq":191121,"id":"MAL-2026-14545","ts":1789369517252,"field":"exploited","old":"false","new":"true"},{"seq":191120,"id":"MAL-2026-14545","ts":1789369517252,"field":"severity","old":"none","new":"critical"},{"seq":189908,"id":"MAL-2026-14545","ts":1789368465360,"field":"exploited","old":"true","new":"false"},{"seq":189907,"id":"MAL-2026-14545","ts":1789368465360,"field":"severity","old":"critical","new":"none"},{"seq":188691,"id":"MAL-2026-14545","ts":1789365251417,"field":"exploited","old":"false","new":"true"},{"seq":188690,"id":"MAL-2026-14545","ts":1789365251417,"field":"severity","old":"none","new":"critical"},{"seq":187478,"id":"MAL-2026-14545","ts":1789363481892,"field":"exploited","old":"true","new":"false"},{"seq":187477,"id":"MAL-2026-14545","ts":1789363481892,"field":"severity","old":"critical","new":"none"},{"seq":186264,"id":"MAL-2026-14545","ts":1789361250261,"field":"exploited","old":"false","new":"true"},{"seq":186263,"id":"MAL-2026-14545","ts":1789361250261,"field":"severity","old":"none","new":"critical"},{"seq":185051,"id":"MAL-2026-14545","ts":1789358407294,"field":"exploited","old":"true","new":"false"},{"seq":185050,"id":"MAL-2026-14545","ts":1789358407294,"field":"severity","old":"critical","new":"none"},{"seq":183300,"id":"MAL-2026-14545","ts":1789354334464,"field":"exploited","old":"false","new":"true"},{"seq":183299,"id":"MAL-2026-14545","ts":1789354334464,"field":"severity","old":"none","new":"critical"},{"seq":182093,"id":"MAL-2026-14545","ts":1789353336916,"field":"exploited","old":"true","new":"false"},{"seq":182092,"id":"MAL-2026-14545","ts":1789353336916,"field":"severity","old":"critical","new":"none"},{"seq":180886,"id":"MAL-2026-14545","ts":1789350307927,"field":"exploited","old":"false","new":"true"},{"seq":180885,"id":"MAL-2026-14545","ts":1789350307927,"field":"severity","old":"none","new":"critical"},{"seq":179679,"id":"MAL-2026-14545","ts":1789348311982,"field":"exploited","old":"true","new":"false"},{"seq":179678,"id":"MAL-2026-14545","ts":1789348311982,"field":"severity","old":"critical","new":"none"},{"seq":178472,"id":"MAL-2026-14545","ts":1789346387740,"field":"exploited","old":"false","new":"true"},{"seq":178471,"id":"MAL-2026-14545","ts":1789346387740,"field":"severity","old":"none","new":"critical"},{"seq":177265,"id":"MAL-2026-14545","ts":1789343191976,"field":"exploited","old":"true","new":"false"},{"seq":177264,"id":"MAL-2026-14545","ts":1789343191976,"field":"severity","old":"critical","new":"none"},{"seq":175382,"id":"MAL-2026-14545","ts":1789334899825,"field":"exploited","old":"false","new":"true"},{"seq":175381,"id":"MAL-2026-14545","ts":1789334899825,"field":"severity","old":"none","new":"critical"},{"seq":174177,"id":"MAL-2026-14545","ts":1789333720571,"field":"exploited","old":"true","new":"false"},{"seq":174176,"id":"MAL-2026-14545","ts":1789333720571,"field":"severity","old":"critical","new":"none"},{"seq":172991,"id":"MAL-2026-14545","ts":1789331109260,"field":"exploited","old":"false","new":"true"},{"seq":172990,"id":"MAL-2026-14545","ts":1789331109260,"field":"severity","old":"none","new":"critical"}]}