MAL-2026-15603Critical▾ Abyssal⚠ Exploited in the wildMalicious code in pyservercheck (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
critical → none
none → critical
critical → none
none → critical
critical → none
none → critical
-= Per source details. Do not edit below this line.=-
The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long run of tab whitespace and a trailing eval(atob('...')) that decodes to a two-stage loader. The decoded loader queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 pair from the tx to field, fetches XOR-obfuscated stage-2 code from http://<decoded-ip>:443/0x/cls and /0x/ls, eval()s it, and re-launches it via a detached spawn('node', ['-e', <code>]). Execution is wired to two auto-triggers: pyproject.toml overrides setuptools build_py and develop with pyservercheck._setup_cmd.BuildPy/Develop, whose run() calls _run_main_js_now() -> subprocess.run(['node', main.js]) during pip install / pip install -e.; and BuildPy also writes a pyservercheck.pth file containing import pyservercheck._hooks; pyservercheck._hooks.ensure_once(), which Python auto-executes at every interpreter startup, invoking run_js() again. The .main_js_ran marker is advisory and can be removed to force re-execution. The C2 destination is rotatable by publishing a new Ethereum transaction from the sender address, so the fetched payload is fully attacker-controlled at each run.
Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.
The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pybitjs
Reasons (based on the campaign):
obfuscation
Downloads and executes a remote malicious script.
malware
abuses-pth
c2-in-blockchain
pyservercheckRefer to the advisory for the patched release.
Field changes observed since this record was first indexed.