Malicious code in pybitjs (PyPI)

The pybitjs PyPI package's setuptools commands invoke a Node.js script during pip install, which writes a .pth file causing the Node.js payload to run on every Python startup. The embedded JavaScript is heavily obfuscated and implements a C2 mechanism by querying Ethereum JSON-RPC endpoints for transactions involving a hardcoded Ethereum address. It extracts an IP address from the blockchain transaction data, fetches an XOR-encrypted payload from that IP, decrypts it, and executes it via eval and detached Node.js processes. This design allows the attacker to dynamically control the C2 server via blockchain transactions, enabling arbitrary remote code execution on affected hosts. The behavior and IoCs align with Lazarus APT/PolinRider campaigns.

Installation or execution of Python with the pybitjs package present results in arbitrary attacker-controlled code execution on the host system. The attacker can dynamically change the C2 server IP via blockchain transactions, enabling persistent and flexible remote control. This compromises the confidentiality, integrity, and availability of the affected system.

No official patch or remediation is currently documented. Users should immediately uninstall the pybitjs package if present and avoid installing or running Python environments containing this package. Monitor for and remove any pybitjs.pth files and related Node.js processes. Check vendor advisories or PyPI for updates or removal notices. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.