MAL-2026-14545
Malicious code in pybitjs (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8) Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.
The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pybitjs
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- malware
- abuses-pth
- c2-in-blockchain
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for pybitjs (pip). Pin to a known-safe version or switch to an alternative.