MAL-2026-15603

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyservercheck/MAL-2026-15603.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15603
Published
2026-08-31T05:02:04Z
Modified
2026-08-31T18:31:28.360366196Z
Summary
Malicious code in pyservercheck (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859)

The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long run of tab whitespace and a trailing eval(atob('...')) that decodes to a two-stage loader. The decoded loader queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 pair from the tx to field, fetches XOR-obfuscated stage-2 code from http://<decoded-ip>:443/0x/cls and /0x/ls, eval()s it, and re-launches it via a detached spawn('node', ['-e', <code>]). Execution is wired to two auto-triggers: pyproject.toml overrides setuptools build_py and develop with pyservercheck.setupcmd.BuildPy/Develop, whose run() calls runmainjsnow() -> subprocess.run(['node', main.js]) during pip install / pip install -e.; and BuildPy also writes a pyservercheck.pth file containing import pyservercheck._hooks; pyservercheck._hooks.ensure_once(), which Python auto-executes at every interpreter startup, invoking run_js() again. The .main_js_ran marker is advisory and can be removed to force re-execution. The C2 destination is rotatable by publishing a new Ethereum transaction from the sender address, so the fetched payload is fully attacker-controlled at each run.

Source: kam193 (4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a)

Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.

The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-pybitjs

Reasons (based on the campaign):

  • obfuscation

  • Downloads and executes a remote malicious script.

  • malware

  • abuses-pth

  • c2-in-blockchain

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-31T05:19:12.057357966Z",
            "id": "pypi/2026-08-pybitjs/pyservercheck",
            "versions": [
                "0.1.0",
                "0.1.1"
            ],
            "source": "kam193",
            "modified_time": "2026-08-31T05:02:04.882072Z",
            "sha256": "4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a"
        },
        {
            "import_time": "2026-08-31T17:16:14.314056352Z",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ],
            "id": "IN-MAL-2026-019174",
            "modified_time": "2026-08-31T16:49:08Z",
            "sha256": "d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859"
        },
        {
            "import_time": "2026-08-31T18:22:26.671572395Z",
            "id": "IN-MAL-2026-019248",
            "versions": [
                "0.1.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-31T17:54:19Z",
            "sha256": "c5e1bb46b88795a27a36cb00f9357e45af504c5c8fbcfbd850601cc11481b0f6"
        }
    ],
    "iocs": {
        "urls": [
            "http://23.27.13.135:443/0x/cls"
        ],
        "ips": [
            "23.27.13.135"
        ]
    }
}
References
Credits

Affected packages

PyPI / pyservercheck

Package

Name
pyservercheck
View open source insights on deps.dev
Purl
pkg:pypi/pyservercheck

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyservercheck/MAL-2026-15603.json"
indicators 
{
    "evidence_files": [
        {
            "path": "pyservercheck/js/main.js",
            "tlsh": "f7226cf5e38225641e7ddd011aa1acc4a227587d3070c385baba0fdd4a85ee9887f69c",
            "sha256": "c746ab75ae87f8ff30537050d0d95c2318cb8eb4d35e82bcee3a3e9018051f45"
        },
        {
            "path": "pyservercheck/_setup_cmd.py",
            "tlsh": "2821cd324d47b42696b3c75c6c138091d3b292570fa44845f8fe56511fbb060867baee",
            "sha256": "bce0f43cd1cc7f146b84822342da5886d7b24fb1846c2d063565d1bfdb88b077"
        }
    ],
    "package_integrity": [
        {
            "filename": "pyservercheck-0.1.1-py3-none-any.whl",
            "hashes": {
                "md5": "fd792c17f989be31cc65ca01ce3802d8",
                "blake2b_256": "c9053640bf3e2802c6e479a103b287429632a11d2dc006912dbbd16a9d4ca6d9",
                "sha256": "7c8bd0ca8e3f7660accc2540c0a33728198ca6a639a5826908ed27a658fcb71b"
            }
        },
        {
            "filename": "pyservercheck-0.1.1.tar.gz",
            "hashes": {
                "md5": "aaa64a284bdb733abda7d7220f9dbef0",
                "blake2b_256": "60070a87281eee394b8ce284c523fba10f10a9bd070ccf2626012d3a7ecfe6e4",
                "sha256": "8ecb12b68e2b1b33bb895e39e430d57c190943aa383ed8f73923ee4ba698c089"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]