MAL-2026-15603
Malicious code in pyservercheck (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a) Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.
The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pybitjs
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- malware
- abuses-pth
- c2-in-blockchain
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for pyservercheck (pip). Pin to a known-safe version or switch to an alternative.