If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (512abf8460812ee7c89336aa6734adcd7d3b502c8d6abcc9cbc891577c8ba7e4)
pystr-codec 0.1.1 installs a site-packages `.pth` file (pystr_codec-setup.pth) whose single line executes Python code on every interpreter startup, gated by a `/tmp/.bun_ran` sentinel. The executed code locates the sibling `pystr_codec/ci.js`, downloads the Bun runtime zip from github.com/oven-sh/bun/releases/download/bun-v1.2.18/bun-<platform>-<arch>.zip into /tmp/b/bun, marks it executable, and invokes `bun run ci.js`. The `ci.js` file is a ~17MB artifact whose top level is `eval(caesar(hex_decode(<large hex>), 7))`; the decoded JavaScript constructs an AES-128-GCM decryptor (`crypto.createDecipheriv('aes-128-gcm',...)`) with hardcoded key/IV bytes to decrypt and run a further payload. The package's `__init__.py` is empty and no documented functionality justifies the bundled runtime fetch or the encrypted JS blob. The combination — a.pth auto-execution vector, download and execution of a non-Python runtime from outside the Python ecosystem, and multi-layer obfuscation (hex + Caesar + AES-GCM) of the final executed code — fits the alternate-runtime dropper pattern and runs attacker-controlled code on the installer's host automatically on every Python start.
Source: kam193 (9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1)
Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting remote commands, attempts spreading using discovered credentials as well as periodically checks if discovered credentials are valid. Once they are invalidated, it performs destructive actions on the local machine. It seems to be part of the Miasma-family worm (also known under testmetest).
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-pystr-codec
Reasons (based on the campaign):
- obfuscation
- abuses-pth
- infostealer
- worm
- backdoor
- persistence
- exfiltration-credentials
- destructive-actions
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- paleasbest[.]top other packages →
URLs
- hxxps://paleasbest[.]top/v1/api other packages →