MAL-2026-14545Critical▾ Abyssal⚠ Exploited in the wildMalicious code in pybitjs (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
critical → none
none → critical
critical → none
none → critical
critical → none
none → critical
-= Per source details. Do not edit below this line.=-
The package's setuptools cmdclasses (BuildPy, Develop) invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing import pybitjs._autorun; pybitjs._autorun.run_main_js_once() so the same Node.js payload is re-executed on every subsequent Python interpreter startup. The bundled pybitjs/js/main.js is heavily string-array obfuscated (obfuscator.io style _0x240a / _0x4963) and implements an EtherHiding-style C2: it queries Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, etherscan-like API) for transactions involving the hardcoded address 0xa322E5f3..., extracts an IPv4 from the transaction data, HTTP-fetches an XOR-encrypted blob from that IP, decrypts it, and passes the decrypted content to eval(...) and to spawn('node', ['-e', <payload>], {detached:true}).unref(). Because the C2 host is dereferenced from an on-chain transaction, the destination is attacker-mutable, and installing or launching Python with this package present causes arbitrary attacker-controlled code to be fetched and executed on the installer's host.
Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.
The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pybitjs
Reasons (based on the campaign):
obfuscation
Downloads and executes a remote malicious script.
malware
abuses-pth
c2-in-blockchain
pybitjsRefer to the advisory for the patched release.
Field changes observed since this record was first indexed.