Skip to content
Open-Source Registry

pypi / pystr-codec / 0.1.2

pystr-codec 0.1.2

bitbison: no public build not built
processes
219
operations
9.4K
packages
0
compiler runs
0
connections
1
build time
8s
job time
8s
capture
110 KB
records
15K
bytes / record
7.2
run 0decfbd4-04a9-41da-a851-c843a916ae01 · built 2026-10-31 · complete View on PyPI
Reviewed by Bitbison: maliciouspystr-codec installs a .pth file that runs obfuscated JavaScript through Bun at every Python start. It reads other tools' credential stores, sends them out, persists, spreads with the stolen credentials, and turns destructive once they are revoked. A Miasma-family worm.

This release did not build; nothing below stands for the package.

Checks

8 of 9 clear · 1 not checked
Build behavior✓✓✓✓✓○✓
Supply chain✓
Pipeline✓

Detections

0

No detections

No abnormal activity detected across 9.4K flows.

Network

1 peers
  • files.pythonhosted.org:8080 the package manager · python3.14 via Package registries profile (pip → files.pythonhosted.org) ecosystem
Versions3RiskVulnsPublished
0.1.2did not build5h ago
0.1.1criticalnone6h ago
0.1.0nonenone6h ago

Raw data

capture
110 KB
records
15,288
bytes per record
7.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import failure · Generated 2026-11-01 · run 0decfbd4-04a9-41da-a851-c843a916ae01

analysis 0.1.0 · 2026-11-01 · af5af45

pystr-codec runs a credential-stealing worm through a Python startup file

maliciousCovers 0.1.0, 0.1.1 and 0.1.2Reviewed by BitbisonUpdated 2026-11-01

pystr-codec installs a .pth file that runs obfuscated JavaScript through Bun at every Python start. It reads other tools' credential stores, sends them out, persists, spreads with the stolen credentials, and turns destructive once they are revoked. A Miasma-family worm.

What it does

pystr-codec installs a startup file, pystr_codec-setup.pth, into the environment's site-packages. Python processes .pth files at every interpreter start, so the payload runs whenever any Python program in that environment starts, whether or not pystr-codec is ever imported. It uses the Bun JavaScript runtime to run obfuscated JavaScript shipped in the package (pystr_codec/ci.js).

In a run of 0.1.1, that code read 47 credential stores belonging to other tools and then connected to paleasbest.top. The OpenSSF record describes the rest: it exfiltrates the credentials it finds to a public GitHub repository, persists and waits for remote commands, tries to spread using the credentials, periodically checks whether they are still valid, and takes destructive action on the machine once they are revoked. The record places it in the Miasma worm family, also known as testmetest.

Timeline

  • Reported to the OpenSSF malicious packages database as MAL-2026-18432: 2026-11-01 00:13 UTC, covering 0.1.0, 0.1.1 and 0.1.2.
  • PyPI has quarantined the project: it is kept, but no files are served.

Indicators

hosts
paleasbest.top
requests
https://paleasbest.top/v1/api
files
site-packages/pystr_codec-setup.pthsite-packages/pystr_codec/ci.js

Links