Malicious code in pyservercheck (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859) The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long run of tab whitespace and a trailing eval(atob('...')) that decodes to a two-stage loader. The decoded loader queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 pair from the tx `to` field, fetches XOR-obfuscated stage-2 code from http://<decoded-ip>:443/0x/cls and /0x/ls, eval()s it, and re-launches it via a detached `spawn('node', ['-e', <code>])`. Execution is wired to two auto-triggers: pyproject.toml overrides setuptools `build_py` and `develop` with pyservercheck._setup_cmd.BuildPy/Develop, whose `run()` calls _run_main_js_now() -> subprocess.run(['node', main.js]) during `pip install` / `pip install -e.`; and BuildPy also writes a `pyservercheck.pth` file containing `import pyservercheck._hooks; pyservercheck._hooks.ensure_once()`, which Python auto-executes at every interpreter startup, invoking run_js() again. The `.main_js_ran` marker is advisory and can be removed to force re-execution. The C2 destination is rotatable by publishing a new Ethereum transaction from the sender address, so the fetched payload is fully attacker-controlled at each run. ## Source: kam193 (4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a) Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain. The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-pybitjs Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script. - malware - abuses-pth - c2-in-blockchain
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The pyservercheck PyPI package versions 0.1.0 and 0.1.1 embed obfuscated JavaScript malware that triggers both during the package build process and on every Python interpreter startup via a PTH file. The malware downloads additional remote stages from a command-and-control server, with the server IP address delivered via a blockchain mechanism. This behavior aligns with known campaigns attributed to the Lazarus APT group, specifically the PolinRider malware family. The campaign is characterized by obfuscation, remote code execution, abuse of PTH files for persistence, and blockchain-based C2 communication.
Potential Impact
Users installing or running Python environments with pyservercheck versions 0.1.0 or 0.1.1 are at risk of executing malicious code that can download and execute further payloads. This can lead to system compromise, data theft, or further malware deployment consistent with Lazarus APT campaigns. The malware's persistence via PTH files means it activates on every Python startup, increasing exposure and potential damage.
Mitigation Recommendations
No official patch or remediation is currently available for pyservercheck versions 0.1.0 and 0.1.1. Users should immediately uninstall these versions and avoid installing pyservercheck from untrusted sources. It is recommended to audit Python environments for the presence of pyservercheck and any suspicious PTH files. Monitor for indicators of compromise consistent with Lazarus APT activity. Since this is a malicious package, the best mitigation is to avoid its use entirely and rely on trusted package sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-15603
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6a95a0feacd9273b4947e90d
Added to database: 08/31/2026, 15:42:54 UTC
Last enriched: 09/09/2026, 10:53:12 UTC
Last updated: 10/01/2026, 22:35:24 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.