pystr-codec (PyPI): .pth file runs a credential-stealing worm on every Python start (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-01
pystr-codec versions 0.1.0, 0.1.1 and 0.1.2 on PyPI are malicious, and no clean release exists. A .pth file in the package runs obfuscated JavaScript on the Bun runtime at every Python interpreter start, so a project does not need to import the package for the payload to run. The payload takes credentials, posts them to a public GitHub repository, keeps a persistent foothold that waits for remote commands, uses the credentials it finds to spread, re-checks them periodically, and performs destructive actions on the host once they stop working. Kam193 (Bad Packages) files it under the 2026-11-pystr-codec campaign, which lists this one package, and calls it part of the Miasma-family worm also known as testmetest; SafeDep's testmetest analysis covers npm only and says that family's lineage to Miasma is not confirmed. GHSA-f93h-mc69-274w and OSV MAL-2026-18432 were published on 2026-11-01. The PyPI project is now quarantined. pypistats logged 221 downloads in the most recent day before the research run, so it was being installed before it was pulled. Remove the package and any .pth files it placed in site-packages, rotate every credential the affected host could reach, and block the IOC domain paleasbest.top named in OSV.
What to do
- Immediately uninstall pystr-codec and remove any .pth files it installed from site-packages (the PyPI project is quarantined, so it cannot be reinstalled)
- Rotate all credentials, tokens, SSH keys and secrets accessible from any machine or CI runner that installed it
- Audit machines for persistence mechanisms and signs of spread or destructive actions
- Check for exfiltration to public GitHub repositories and revoke exposed secrets
- Block the IOC domain paleasbest.top (OSV MAL-2026-18432) and flag pystr-codec in dependency resolution; scan build environments for Miasma/testmetest indicators
Sources
All live incidents on Threat Watch
