{"id":"MAL-2026-15603","title":"Malicious code in pyservercheck (PyPI)","summary":"Malicious code in pyservercheck (PyPI)","severity":"critical","exploited":true,"vendor":"pyservercheck","product":"pyservercheck","ecosystem":"pip","affected":["pyservercheck"],"published":"2026-08-31","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:45:04.522065161Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-15603","references":[{"url":"https://github.com/stamparm/maltrail/blob/12360952bc81865dc973e33e5033cea6e1fcc342/trails/static/malware/apt_lazarus.txt#L7414"},{"url":"https://etherscan.io/address/0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a"},{"url":"https://bad-packages.kam193.eu/pypi/package/pyservercheck"},{"url":"https://pypi.org/project/pyservercheck/0.1.1/"},{"url":"https://pypi.org/project/pyservercheck/0.1.0/"},{"url":"https://blog.deception.pro/blog/hok-dprk-polinrider-sep-2026"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-08-31T19:30:39.583Z","slug":"MAL-2026-15603","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859)\nThe package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long run of tab whitespace and a trailing eval(atob('...')) that decodes to a two-stage loader. The decoded loader queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 pair from the tx `to` field, fetches XOR-obfuscated stage-2 code from http://<decoded-ip>:443/0x/cls and /0x/ls, eval()s it, and re-launches it via a detached `spawn('node', ['-e', <code>])`. Execution is wired to two auto-triggers: pyproject.toml overrides setuptools `build_py` and `develop` with pyservercheck._setup_cmd.BuildPy/Develop, whose `run()` calls _run_main_js_now() -> subprocess.run(['node', main.js]) during `pip install` / `pip install -e.`; and BuildPy also writes a `pyservercheck.pth` file containing `import pyservercheck._hooks; pyservercheck._hooks.ensure_once()`, which Python auto-executes at every interpreter startup, invoking run_js() again. The `.main_js_ran` marker is advisory and can be removed to force re-execution. The C2 destination is rotatable by publishing a new Ethereum transaction from the sender address, so the fetched payload is fully attacker-controlled at each run.\n\n## Source: kam193 (4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a)\nPackage embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain. \n\nThe payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-pybitjs\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - malware\n\n\n - abuses-pth\n\n\n - c2-in-blockchain\n\n\n## Affected packages\n\n- `pyservercheck`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[{"seq":202645,"id":"MAL-2026-15603","ts":1789400122938,"field":"exploited","old":"false","new":"true"},{"seq":202644,"id":"MAL-2026-15603","ts":1789400122938,"field":"severity","old":"none","new":"critical"},{"seq":201372,"id":"MAL-2026-15603","ts":1789397624850,"field":"exploited","old":"true","new":"false"},{"seq":201371,"id":"MAL-2026-15603","ts":1789397624850,"field":"severity","old":"critical","new":"none"},{"seq":200065,"id":"MAL-2026-15603","ts":1789395588329,"field":"exploited","old":"false","new":"true"},{"seq":200064,"id":"MAL-2026-15603","ts":1789395588329,"field":"severity","old":"none","new":"critical"},{"seq":199302,"id":"MAL-2026-15603","ts":1789392266075,"field":"exploited","old":"true","new":"false"},{"seq":199301,"id":"MAL-2026-15603","ts":1789392266075,"field":"severity","old":"critical","new":"none"},{"seq":197635,"id":"MAL-2026-15603","ts":1789384307612,"field":"exploited","old":"false","new":"true"},{"seq":197634,"id":"MAL-2026-15603","ts":1789384307612,"field":"severity","old":"none","new":"critical"},{"seq":196909,"id":"MAL-2026-15603","ts":1789383784877,"field":"exploited","old":"true","new":"false"},{"seq":196908,"id":"MAL-2026-15603","ts":1789383784877,"field":"severity","old":"critical","new":"none"},{"seq":195813,"id":"MAL-2026-15603","ts":1789380596233,"field":"exploited","old":"false","new":"true"},{"seq":195812,"id":"MAL-2026-15603","ts":1789380596233,"field":"severity","old":"none","new":"critical"},{"seq":194764,"id":"MAL-2026-15603","ts":1789378793656,"field":"exploited","old":"true","new":"false"},{"seq":194763,"id":"MAL-2026-15603","ts":1789378793656,"field":"severity","old":"critical","new":"none"},{"seq":193551,"id":"MAL-2026-15603","ts":1789376560782,"field":"exploited","old":"false","new":"true"},{"seq":193550,"id":"MAL-2026-15603","ts":1789376560782,"field":"severity","old":"none","new":"critical"},{"seq":192338,"id":"MAL-2026-15603","ts":1789373644452,"field":"exploited","old":"true","new":"false"},{"seq":192337,"id":"MAL-2026-15603","ts":1789373644452,"field":"severity","old":"critical","new":"none"},{"seq":191123,"id":"MAL-2026-15603","ts":1789369517431,"field":"exploited","old":"false","new":"true"},{"seq":191122,"id":"MAL-2026-15603","ts":1789369517431,"field":"severity","old":"none","new":"critical"},{"seq":189910,"id":"MAL-2026-15603","ts":1789368465499,"field":"exploited","old":"true","new":"false"},{"seq":189909,"id":"MAL-2026-15603","ts":1789368465499,"field":"severity","old":"critical","new":"none"},{"seq":188693,"id":"MAL-2026-15603","ts":1789365251545,"field":"exploited","old":"false","new":"true"},{"seq":188692,"id":"MAL-2026-15603","ts":1789365251545,"field":"severity","old":"none","new":"critical"},{"seq":187480,"id":"MAL-2026-15603","ts":1789363481906,"field":"exploited","old":"true","new":"false"},{"seq":187479,"id":"MAL-2026-15603","ts":1789363481906,"field":"severity","old":"critical","new":"none"},{"seq":186266,"id":"MAL-2026-15603","ts":1789361250274,"field":"exploited","old":"false","new":"true"},{"seq":186265,"id":"MAL-2026-15603","ts":1789361250274,"field":"severity","old":"none","new":"critical"},{"seq":185053,"id":"MAL-2026-15603","ts":1789358407444,"field":"exploited","old":"true","new":"false"},{"seq":185052,"id":"MAL-2026-15603","ts":1789358407444,"field":"severity","old":"critical","new":"none"},{"seq":183302,"id":"MAL-2026-15603","ts":1789354334478,"field":"exploited","old":"false","new":"true"},{"seq":183301,"id":"MAL-2026-15603","ts":1789354334478,"field":"severity","old":"none","new":"critical"},{"seq":182095,"id":"MAL-2026-15603","ts":1789353336930,"field":"exploited","old":"true","new":"false"},{"seq":182094,"id":"MAL-2026-15603","ts":1789353336930,"field":"severity","old":"critical","new":"none"},{"seq":180888,"id":"MAL-2026-15603","ts":1789350308064,"field":"exploited","old":"false","new":"true"},{"seq":180887,"id":"MAL-2026-15603","ts":1789350308064,"field":"severity","old":"none","new":"critical"},{"seq":179681,"id":"MAL-2026-15603","ts":1789348312141,"field":"exploited","old":"true","new":"false"},{"seq":179680,"id":"MAL-2026-15603","ts":1789348312141,"field":"severity","old":"critical","new":"none"},{"seq":178474,"id":"MAL-2026-15603","ts":1789346387754,"field":"exploited","old":"false","new":"true"},{"seq":178473,"id":"MAL-2026-15603","ts":1789346387754,"field":"severity","old":"none","new":"critical"},{"seq":177267,"id":"MAL-2026-15603","ts":1789343192117,"field":"exploited","old":"true","new":"false"},{"seq":177266,"id":"MAL-2026-15603","ts":1789343192117,"field":"severity","old":"critical","new":"none"},{"seq":175384,"id":"MAL-2026-15603","ts":1789334899832,"field":"exploited","old":"false","new":"true"},{"seq":175383,"id":"MAL-2026-15603","ts":1789334899832,"field":"severity","old":"none","new":"critical"},{"seq":174179,"id":"MAL-2026-15603","ts":1789333720577,"field":"exploited","old":"true","new":"false"},{"seq":174178,"id":"MAL-2026-15603","ts":1789333720577,"field":"severity","old":"critical","new":"none"},{"seq":172993,"id":"MAL-2026-15603","ts":1789331109267,"field":"exploited","old":"false","new":"true"},{"seq":172992,"id":"MAL-2026-15603","ts":1789331109267,"field":"severity","old":"none","new":"critical"}]}