MAL-2026-18432

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pystr-codec/MAL-2026-18432.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18432
Published
2026-11-01T00:13:02Z
Modified
2026-11-01T00:45:06Z
Summary
Malicious code in pystr-codec (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1)

Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting remote commands, attempts spreading using discovered credentials as well as periodically checks if discovered credentials are valid. Once they are invalidated, it performs destructive actions on the local machine. It seems to be part of the Miasma-family worm (also known under testmetest).

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-pystr-codec

Reasons (based on the campaign):

  • obfuscation

  • abuses-pth

  • infostealer

  • worm

  • backdoor

  • persistence

  • exfiltration-credentials

  • destructive-actions

Database specific 
{
    "iocs":  {
        "domains":  [
            "paleasbest.top"
        ],
        "urls":  [
            "https://paleasbest.top/v1/api"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-11-pystr-codec/pystr-codec",
            "import_time":  "2026-11-01T00:35:45.944292912Z",
            "modified_time":  "2026-11-01T00:13:02.21675Z",
            "sha256":  "9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1",
            "source":  "kam193",
            "versions":  [
                "0.1.0",
                "0.1.1",
                "0.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / pystr-codec

Package

Name
pystr-codec
View open source insights on deps.dev
Purl
pkg:pypi/pystr-codec

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pystr-codec/MAL-2026-18432.json"