pystr-codec@0.1.2

Summary

Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting remote commands, attempts spreading using discovered credentials as well as periodically checks if discovered credentials are valid. Once they are invalidated, it performs destructive actions on the local machine. It seems to be part of the Miasma-family worm (also known under testmetest). --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-pystr-codec Reasons (based on the campaign): - obfuscation - abuses-pth - infostealer - worm - backdoor - persistence - exfiltration-credentials - destructive-actions

Source: kam193 (9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1)