MAL-2026-14545

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pybitjs/MAL-2026-14545.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14545
Published
2026-08-26T19:21:41Z
Modified
2026-08-27T04:00:13.761949039Z
Summary
Malicious code in pybitjs (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5)

The package's setuptools cmdclasses (BuildPy, Develop) invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing import pybitjs._autorun; pybitjs._autorun.run_main_js_once() so the same Node.js payload is re-executed on every subsequent Python interpreter startup. The bundled pybitjs/js/main.js is heavily string-array obfuscated (obfuscator.io style _0x240a / _0x4963) and implements an EtherHiding-style C2: it queries Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, etherscan-like API) for transactions involving the hardcoded address 0xa322E5f3..., extracts an IPv4 from the transaction data, HTTP-fetches an XOR-encrypted blob from that IP, decrypts it, and passes the decrypted content to eval(...) and to spawn('node', ['-e', <payload>], {detached:true}).unref(). Because the C2 host is dereferenced from an on-chain transaction, the destination is attacker-mutable, and installing or launching Python with this package present causes arbitrary attacker-controlled code to be fetched and executed on the installer's host.

Source: kam193 (8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8)

Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.

The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-pybitjs

Reasons (based on the campaign):

  • obfuscation

  • Downloads and executes a remote malicious script.

  • malware

  • abuses-pth

  • c2-in-blockchain

Database specific 
{
    "iocs": {
        "ips": [
            "23.27.13.135"
        ],
        "urls": [
            "http://23.27.13.135:443/0x/cls"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-08-pybitjs/pybitjs",
            "sha256": "8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8",
            "source": "kam193",
            "modified_time": "2026-08-26T19:21:41.13954Z",
            "import_time": "2026-08-26T20:55:33.8623504Z",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018762",
            "sha256": "611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5",
            "source": "amazon-inspector",
            "modified_time": "2026-08-27T02:56:17Z",
            "import_time": "2026-08-27T03:55:24.459222868Z",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / pybitjs

Package

Name
pybitjs
View open source insights on deps.dev
Purl
pkg:pypi/pybitjs

Affected ranges

Affected versions

0.*
0.1.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "pybitjs-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "1d019404be807e2eac95590ff01a59423f6c4008ee1891df0d3fc1fed0b75b22",
                "sha256": "71fccb4b146bd7b8d3c55a493a34a301b220ca72af5a6e92e7bae4135953fc17",
                "md5": "040ee49bc6e196601ccc32644bc520a8"
            }
        },
        {
            "hashes": {
                "blake2b_256": "c7603e8ce1ac02df7b538e42113f5575d71e900a6e596b2784371d2de8fbebb3",
                "sha256": "8355734423650ec61c10dcac725645a0d506f9dbd869935c8de8cb545bd40582",
                "md5": "ccad7bc111ae37db310a78dfd0c132de"
            },
            "filename": "pybitjs-0.1.0.tar.gz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "3412cc9f8fc3de5b22181c17e36954e2efd405d761235c3f246809a59ea67bbe",
            "tlsh": "2021ce229e4bb07093b2cb5c6c53c192d37653671ea84445f8fe2a411f77064876a6ff",
            "path": "pybitjs/_setup_cmd.py"
        },
        {
            "sha256": "4993aa30d2d541be164763583a0b87f4a8c6f1d0c47a7c8a83b211600b3304e1",
            "tlsh": "dfe23284a7d0a440034b6abbbb1bf4e5e96a0cac75844acbf11dbd84f766327e4f1531",
            "path": "pybitjs/js/main.js"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pybitjs/MAL-2026-14545.json"