Source: kam193 (8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8)

Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.

The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-pybitjs

Reasons (based on the campaign):

• obfuscation

• Downloads and executes a remote malicious script.

• malware

• abuses-pth

• c2-in-blockchain

Credit: OpenSSF (source)

References

• https://bad-packages.kam193.eu/pypi/package/pybitjs
• https://etherscan.io/address/0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a
• https://github.com/ossf/malicious-packages/blob/c2b77288140394a287dd6f8fea9cf3152f7695b1/osv/malicious/pypi/pybitjs/MAL-2026-14545.json
• https://github.com/stamparm/maltrail/blob/12360952bc81865dc973e33e5033cea6e1fcc342/trails/static/malware/apt_lazarus.txt#L7414
• https://github.com/ossf/malicious-packages/blob/f2bfa7cff75744676f9da334b2667bf33792499e/osv/malicious/pypi/pybitjs/MAL-2026-14545.json
• https://pypi.org/project/pybitjs/0.1.0