The pystr-codec package on PyPI contains malicious code that executes on every Python startup. It runs obfuscated JavaScript via a Bun engine to exfiltrate credentials to a public GitHub repository, establish persistence, accept remote commands, spread using stolen credentials, and perform destructive actions if credentials become invalid. This malware is linked to the Miasma-family worm.