pybitjs

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: kam193 (8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8)
Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain. 

The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-pybitjs


Reasons (based on the campaign):


 - obfuscation


 - Downloads and executes a remote malicious script.


 - malware


 - abuses-pth


 - c2-in-blockchain

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c2b77288140394a287dd6f8fea9cf3152f7695b1/osv/malicious/pypi/pybitjs/MAL-2026-14545.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/pybitjs
- https://etherscan.io/address/0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a
- https://github.com/ossf/malicious-packages/blob/c2b77288140394a287dd6f8fea9cf3152f7695b1/osv/malicious/pypi/pybitjs/MAL-2026-14545.json
- https://github.com/stamparm/maltrail/blob/12360952bc81865dc973e33e5033cea6e1fcc342/trails/static/malware/apt_lazarus.txt#L7414
- https://github.com/ossf/malicious-packages/blob/f2bfa7cff75744676f9da334b2667bf33792499e/osv/malicious/pypi/pybitjs/MAL-2026-14545.json
- https://pypi.org/project/pybitjs/0.1.0
- https://blog.deception.pro/blog/hok-dprk-polinrider-sep-2026
- https://github.com/ossf/malicious-packages/blob/57b6188dbbb92f942b0756bd83bcce5d5563d1d5/osv/malicious/pypi/pybitjs/MAL-2026-14545.json

Compromised versions (1)

• = 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.