pystr-codec PyPI package carries Miasma worm payload under testmetest alias

CriticalMalicious packagePyPI

kam193 and OpenSSF flagged pystr-codec@0.1.0, 0.1.1, 0.1.2 on PyPI (GHSA-f93h-mc69-274w / MAL-2026-18432) as a Miasma-family worm variant - the first observed PyPI incarnation of the self-propagating credential-stealing worm previously seen on npm as the June 2026 @redhat-cloud-services / Leo Platform / testmetest campaigns. The package drops a malicious .pth file that runs on every Python startup, executes obfuscated JavaScript under a downloaded Bun runtime, exfiltrates credentials to a public GitHub repo via paleasbest.top, awaits remote commands, re-spreads using harvested credentials, and performs destructive actions on hosts whose credentials are later invalidated.

Published 1 Nov 2026

Check your requirements.txt Source advisory

At a glancepypi-2026-11-01-pystr-codec-miasma-worm

Package tracked3 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity: Critical
Type: Malicious package
Published: 1 Nov 2026
Ecosystems: PyPI
Detected by: OpenSSF Package Analysis, kam193, SafeDep
Also known as: Miasma, testmetest, Shai-Hulud Hades
Source: github.com

Malicious package. A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.

What happened

The full picture

On 2026-11-01 OpenSSF published MAL-2026-18432 and GitHub published GHSA-f93h-mc69-274w for the PyPI package pystr-codec, three versions (0.1.0, 0.1.1, 0.1.2). kam193`s analysis - cited in the OSSF record and the GitHub advisory - identifies the package as the first observed PyPI incarnation of the Miasma-family worm, cross-cited by SafeDep under the operator alias testmetest.

Why this matters

Miasma is a known self-propagating credential-stealing worm first captured by Wiz / ReversingLabs / JFrog in June 2026 on the @redhat-cloud-services npm compromise, extended to 20 Leo Platform / RStreams npm packages under the Shai-Hulud "Hades" payload on 2026-06-24, and incrementally iterated on npm through the summer. The signature pattern is a lifecycle-script-free install hook (originally via a binding.gyp node-gyp command-substitution trick, now via a Python .pth on-startup hook), followed by a dropper that downloads the Bun runtime (to escape Node-level EDR instrumentation) and runs a credential sweep covering every cloud provider, every package registry, every secrets manager and every developer-identity artefact on the host. The self-spread step uses harvested publish tokens to publish fresh malicious versions under the victim`s own maintainer identity, giving the worm exponential growth under a chain of maintainer accounts rather than a single operator identity.

What is new today

pystr-codec is the first observed PyPI variant. The persistence primitive moves from npms binding.gyp + node-gyp rebuild command-substitution trick to PyPIs .pth + site-packages auto-evaluation trick - a direct ecosystem port that preserves the familys core advantage: no postinstall / preinstall / setup.py install lifecycle script shows up in a lockfile audit, because the hook is Pythons built-in startup-file mechanism, not a packaging-system hook. Every python invocation on the compromised host runs the loader, including non-interactive CI processes that only import a single module.

IOCs (from OSSF MAL-2026-18432)

Domain: paleasbest.top
URL: https://paleasbest.top/v1/api
Source hash (kam193 analysis): SHA-256 9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1
OSSF campaign tag: 2026-11-pystr-codec
OSSF reason tags: obfuscation, abuses-pth, infostealer, worm, backdoor, persistence, exfiltration-credentials, destructive-actions

Family IOCs to carry forward from prior Miasma waves

Bun runtime binary: Bun-1.3.13-linux-x64.zip on build hosts that do not normally use Bun
Toolkit path: /tmp/p.js (npm variant; PyPI variant`s equivalent path not yet published)
Dead-drop channel: attacker-controlled public GitHub repositories receiving commits authored by the installing host`s GitHub identity
npm bypass_2fa automation-token API usage (watch publish logs for maintainers who have 2FA enabled)

Attribution and alias linkage

SafeDep tracks the operator / tool family under the alias testmetest - the OSSF record for pystr-codec cites testmetest npm worm Miasma variant as the primary analysis article. The -testmetest suffix npm slug family catalogued across the 2026-10-22, 2026-10-25 (event-bus-lite-testmetest), 2026-10-26 (path-stream-utils-testmetest), and prior sweeps is the same operator per todays OSSF-and-SafeDep cross-attribution. The 2026-10-25 event-bus-lite-testmetest@0.0.6 Bun-runtime binding.gyp loader (payload hash e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73`, confirmed Brotli + AES-128-GCM encrypted Bun payload under the TanStack / Mini Shai-Hulud TTP family) is now the strongest-published-sample reference for what the npm side of this family deploys.

Classification

malicious-package. Severity critical - this is a confirmed self-propagating credential-stealing worm with destructive-actions trigger on a package whose only reach is anyone who installs the typosquat slug, but every host that resolved it is fully compromised at import time plus has a live backdoor plus will be wiped on credential rotation. The combination of worm propagation (makes blast radius unbounded in dependency chains that pin maintainer identities rather than slugs) and conditional-wiper destructive actions (makes incident response itself the detonation trigger) is why this clears the critical threshold even though no legitimate widely-used PyPI package was hijacked today.

worminfostealercredential-theftci-cd-compromiseobfuscationpersistence

Affected packages

1 package 3 versions

PyPIpystr-codec0.1.00.1.10.1.2→

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check requirements.txt →

Impact

What it does if you installed it

Install-time persistence via Python .pth hook - the package writes a .pth file into the site-packages directory, which Python evaluates automatically on every interpreter startup. The hook runs an obfuscated JavaScript stage under the Bun runtime (downloaded at runtime, not Node). This is the PyPI analogue of the Miasma-family npm binding.gyp + Bun-runtime loader pattern first captured by StepSecurity / SafeDep / JFrog on the June 2026 @redhat-cloud-services and Leo Platform compromises - a persistence primitive that fires on every Python invocation, not just on python -m <pkg> or import <pkg>
Credential sweep (OSSF reason tags infostealer + exfiltration-credentials) - the Miasma payload family harvests AWS (IMDS, Secrets Manager, SSM, ECS task-role), GCP (metadata, service-account keys), Azure (managed identity, Key Vault, federated creds), HashiCorp Vault (probes 10+ token-file locations), Kubernetes SA tokens, npm / PyPI / RubyGems / JFrog publish tokens, GitHub PATs (especially gh CLI configs), shell history, env variables, and 1Password session tokens. The pystr-codec samples exact harvester list is not published on the GHSA page but OSSF tags exfiltration-credentials` and the shared Miasma family attribution make the standard family sweep the operating assumption until a per-sample analysis lands
Backdoor + remote-command execution (OSSF reason tags backdoor + persistence) - after the initial exfil the implant awaits remote commands from the operator, so any host that imported the module during the 0.1.0 - 0.1.2 window must be treated as having had a live attacker channel, not just a point-in-time credential leak
Worm propagation (OSSF reason tag worm) - the Miasma family self-spreads by using harvested npm publish tokens to call npms automation-token bypass_2fa API and publish fresh malicious versions to every package the victim can write to. The PyPI equivalent uses harvested PyPI API tokens the same way; any PyPI publish token found on the host is assumed to have been used to republish wave-N variants under the maintainers own name
Destructive actions on credential invalidation (OSSF reason tag destructive-actions) - the implant periodically re-checks whether the harvested credentials are still valid. Once a credential it holds is invalidated (rotation, revocation, account closure) the local-machine destructive sequence runs - this is a wiper trigger explicitly conditioned on the defender`s remediation action, so hasty credential rotation on an exposed host can itself cause the wipe. Image the host for forensics BEFORE rotating any credential
Exfiltration channel - OSSF publishes two IOCs on the pystr-codec sample: domain paleasbest.top and URL https://paleasbest.top/v1/api. The Miasma family additionally commits exfil envelopes to an attacker-controlled public GitHub repository (dead-drop channel using the victims own GitHub token). Watch for both outbound HTTPS to paleasbest.top and anomalous commits/repo-creates authored by the installing hosts GitHub identity
Alias / family linkage - OSSFs pystr-codec record cites the SafeDep write-up [testmetest npm worm, Miasma variant](https://safedep.io/testmetest-npm-worm-miasma-variant/), tying the npm -testmetest slug suffix family (sdk-utils-testmetest, kvarzo8f3atestmetest on 2026-10-22; event-bus-lite-testmetest@0.0.6 on 2026-10-25 with confirmed Bun loader; path-stream-utils-testmetest on 2026-10-26; and the broader 2026-10-22 npm batch net-codec-testmetest, log-rotate-testmetest, pixel-map-testmetest, event-emitter-testmetest, log-sink-testmetest, test-brotli-testmetest, test-brotli2-testmetest, data-pipeline-testmetest) to this same operator / tool family. The prior catalogue entries treated those npm testmetest slugs as "research / canary" artefacts - todays pystr-codec attribution upgrades the family to confirmed Miasma variant*

What to do

Clean-up steps

Immediate remediation - grep every requirements.txt, Pipfile, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, Dockerfile, container-image manifest, and sandbox lockfile for the exact slug pystr-codec and the exact versions 0.1.0, 0.1.1, 0.1.2. On any hit assume full-host compromise: pull the host off network, image for forensics BEFORE rotating any credential (the implant`s destructive path triggers on credential invalidation, so rotating first can detonate the wiper on the still-running agent)
Then rotate every credential reachable from the host - AWS access keys + ECS task role + Secrets Manager / SSM / Parameter Store entries; GCP service-account keys; Azure managed-identity tokens; Kubernetes SA tokens; Vault tokens; npm publish tokens (automation and classic); PyPI API tokens; RubyGems / JFrog tokens; GitHub PATs (especially long-lived gh CLI tokens, SSH keys with ~/.gitconfig credential helpers); 1Password session tokens; shell-history-captured secrets
Audit PyPI publish history - if any PyPI API token on the compromised host had publish rights to legitimate packages, assume Miasmas self-spread step published malicious wave-N versions under that maintainers identity. Enumerate every PyPI project the hosts token could write to and audit publish timestamps for the last 7 days against the maintainers expected release cadence; yank anything out of band
Audit GitHub for exfil dead-drops - the Miasma family commits exfil envelopes to attacker-controlled or victim-shadow repositories using the victim`s own GitHub token. Enumerate every repository created, forked, or committed to under the exposed GitHub identity in the last 7 days; delete attacker-created repos and revoke any PAT the host held
Egress block - add paleasbest.top apex (and the https://paleasbest.top/v1/api path) to the organisation-wide egress denylist. Carry forward the Miasma family IOCs already in the standing denylist from the June 2026 Leo Platform / @redhat-cloud-services sweeps (Bun-1.3.13-linux-x64.zip, /tmp/p.js toolkit path, dead-drop GitHub commit shape)
Add file-integrity alerts - watch build-runner hosts for new .pth files appearing under any site-packages directory, and watch for the Bun runtime binary appearing on hosts that do not normally use Bun. Both are strong Miasma family signals on PyPI (the .pth hook is the PyPI equivalent of the npm binding.gyp trick)
Family watch - continue to treat any npm or PyPI slug carrying the -testmetest suffix (or the testmetest substring) as part of this operator family until the campaign stops iterating. Add the bare -testmetest suffix as a prefix-wildcard watch on both npm and PyPI mirrors if operational posture allows

References

Sources

pypi-2026-11-01-pystr-codec-miasma-wormBack to incidents Submit a correction

Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your requirements.txt All incidents