MAL-2026-14545 Malicious code in pybitjs (PyPI)

The package's setuptools cmdclasses (BuildPy, Develop) invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing import pybitjs._autorun; pybitjs._autorun.run_main_js_once() so the same Node.js payload is re-executed on every subsequent Python interpreter startup. The bundled pybitjs/js/main.js is heavily string-array obfuscated (obfuscator.io style _0x240a / _0x4963) and implements an EtherHiding-style C2: it queries Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, etherscan-like API) for transactions involving the hardcoded address 0xa322E5f3..., extracts an IPv4 from the transaction data, HTTP-fetches an XOR-encrypted blob from that IP, decrypts it, and passes the decrypted content to eval(...) and to spawn('node', ['-e', <payload>], {detached:true}).unref(). Because the C2 host is dereferenced from an on-chain transaction, the destination is attacker-mutable, and installing or launching Python with this package present causes arbitrary attacker-controlled code to be fetched and executed on the installer's host.

Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.

The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-pybitjs

Reasons (based on the campaign):

• obfuscation

• Downloads and executes a remote malicious script.

• malware

• abuses-pth

• c2-in-blockchain