Skip to content
Open-Source Registry

pypi / pystr-codec / 0.1.0

pystr-codec 0.1.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RisknoneVulnsnone
processes
268
operations
11K
packages
0
compiler runs
4
connections
1
build time
9s
job time
9s
capture
116 KB
records
17K
bytes / record
6.7
run 90d4fab6-ab5d-4ec2-9c47-b6eabe793e34 · built 2026-10-31 · complete View on PyPI
Reviewed by Bitbison: maliciouspystr-codec installs a .pth file that runs obfuscated JavaScript through Bun at every Python start. It reads other tools' credential stores, sends them out, persists, spreads with the stolen credentials, and turns destructive once they are revoked. A Miasma-family worm.

Artifact

archive · retained · retained · graph v2
1

Checks

8 of 9 clear · 1 not checked
Build behavior✓✓✓✓✓○✓
Supply chain✓
Pipeline✓

Detections

0

No detections

No abnormal activity detected across 11K flows.

Network

1 peers
  • files.pythonhosted.org:8080 the package manager · python3.14 via Package registries profile (pip → files.pythonhosted.org) ecosystem
Versions3RiskVulnsPublished
0.1.2did not build5h ago
0.1.1criticalnone6h ago
0.1.0nonenone6h ago

Raw data

capture
116 KB
records
17,298
bytes per record
6.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-11-01 · run 90d4fab6-ab5d-4ec2-9c47-b6eabe793e34

analysis 0.1.0 · 2026-11-01 · af5af45 · graph v2

pystr-codec runs a credential-stealing worm through a Python startup file

maliciousCovers 0.1.0, 0.1.1 and 0.1.2Reviewed by BitbisonUpdated 2026-11-01

pystr-codec installs a .pth file that runs obfuscated JavaScript through Bun at every Python start. It reads other tools' credential stores, sends them out, persists, spreads with the stolen credentials, and turns destructive once they are revoked. A Miasma-family worm.

What it does

pystr-codec installs a startup file, pystr_codec-setup.pth, into the environment's site-packages. Python processes .pth files at every interpreter start, so the payload runs whenever any Python program in that environment starts, whether or not pystr-codec is ever imported. It uses the Bun JavaScript runtime to run obfuscated JavaScript shipped in the package (pystr_codec/ci.js).

In a run of 0.1.1, that code read 47 credential stores belonging to other tools and then connected to paleasbest.top. The OpenSSF record describes the rest: it exfiltrates the credentials it finds to a public GitHub repository, persists and waits for remote commands, tries to spread using the credentials, periodically checks whether they are still valid, and takes destructive action on the machine once they are revoked. The record places it in the Miasma worm family, also known as testmetest.

Timeline

  • Reported to the OpenSSF malicious packages database as MAL-2026-18432: 2026-11-01 00:13 UTC, covering 0.1.0, 0.1.1 and 0.1.2.
  • PyPI has quarantined the project: it is kept, but no files are served.

Indicators

hosts
paleasbest.top
requests
https://paleasbest.top/v1/api
files
site-packages/pystr_codec-setup.pthsite-packages/pystr_codec/ci.js

Links