# pystr-codec PyPI package carries Miasma worm payload under testmetest alias

> kam193 and OpenSSF flagged `pystr-codec@0.1.0, 0.1.1, 0.1.2` on PyPI (GHSA-f93h-mc69-274w / MAL-2026-18432) as a Miasma-family worm variant - the first observed PyPI incarnation of the self-propagating credential-stealing worm previously seen on npm as the June 2026 `@redhat-cloud-services` / Leo Platform / testmetest campaigns. The package drops a malicious `.pth` file that runs on every Python startup, executes obfuscated JavaScript under a downloaded Bun runtime, exfiltrates credentials to a public GitHub repo via `paleasbest.top`, awaits remote commands, re-spreads using harvested credentials, and performs destructive actions on hosts whose credentials are later invalidated.

- Published: 2026-11-01
- Severity: critical
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: PyPI
- Scope: 1 package, 3 compromised versions
- Tags: worm, infostealer, credential-theft, ci-cd-compromise, obfuscation, persistence
- Also known as: Miasma, testmetest, Shai-Hulud Hades, 2026-11-pystr-codec, Phantom Pth
- Detected by: OpenSSF Package Analysis, kam193, SafeDep
- Incident ID: pypi-2026-11-01-pystr-codec-miasma-worm

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [pystr-codec](https://dependencywatch.io/package/pypi/pystr-codec) | PyPI | 0.1.0, 0.1.1, 0.1.2 |

## What happened

On 2026-11-01 OpenSSF published MAL-2026-18432 and GitHub published GHSA-f93h-mc69-274w for the PyPI package `pystr-codec`, three versions (0.1.0, 0.1.1, 0.1.2). kam193`s analysis - cited in the OSSF record and the GitHub advisory - identifies the package as the first observed PyPI incarnation of the **Miasma-family worm**, cross-cited by SafeDep under the operator alias **testmetest**.

## Why this matters

Miasma is a known self-propagating credential-stealing worm first captured by Wiz / ReversingLabs / JFrog in June 2026 on the `@redhat-cloud-services` npm compromise, extended to [20 Leo Platform / RStreams npm packages](https://dependencywatch.io/incident/npm-2026-06-24-leo-platform-miasma-hades) under the Shai-Hulud "Hades" payload on 2026-06-24, and incrementally iterated on npm through the summer. The signature pattern is a lifecycle-script-free install hook (originally via a `binding.gyp` `node-gyp` command-substitution trick, now via a Python `.pth` on-startup hook), followed by a dropper that downloads the Bun runtime (to escape Node-level EDR instrumentation) and runs a credential sweep covering every cloud provider, every package registry, every secrets manager and every developer-identity artefact on the host. The self-spread step uses harvested publish tokens to publish fresh malicious versions under the victim`s own maintainer identity, giving the worm exponential growth under a chain of maintainer accounts rather than a single operator identity.

## What is new today

`pystr-codec` is the **first observed PyPI variant**. The persistence primitive moves from npm`s `binding.gyp` + `node-gyp rebuild` command-substitution trick to PyPI`s `.pth` + site-packages auto-evaluation trick - a direct ecosystem port that preserves the family`s core advantage: no `postinstall` / `preinstall` / `setup.py install` lifecycle script shows up in a lockfile audit, because the hook is Python`s built-in startup-file mechanism, not a packaging-system hook. Every `python` invocation on the compromised host runs the loader, including non-interactive CI processes that only import a single module.

## IOCs (from OSSF MAL-2026-18432)

- Domain: `paleasbest.top`
- URL: `https://paleasbest.top/v1/api`
- Source hash (kam193 analysis): SHA-256 `9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1`
- OSSF campaign tag: `2026-11-pystr-codec`
- OSSF reason tags: `obfuscation`, `abuses-pth`, `infostealer`, `worm`, `backdoor`, `persistence`, `exfiltration-credentials`, `destructive-actions`

## Family IOCs to carry forward from prior Miasma waves

- Bun runtime binary: `Bun-1.3.13-linux-x64.zip` on build hosts that do not normally use Bun
- Toolkit path: `/tmp/p.js` (npm variant; PyPI variant`s equivalent path not yet published)
- Dead-drop channel: attacker-controlled public GitHub repositories receiving commits authored by the installing host`s GitHub identity
- npm `bypass_2fa` automation-token API usage (watch publish logs for maintainers who have 2FA enabled)

## Attribution and alias linkage

SafeDep tracks the operator / tool family under the alias **testmetest** - the OSSF record for pystr-codec cites [testmetest npm worm Miasma variant](https://safedep.io/testmetest-npm-worm-miasma-variant/) as the primary analysis article. The `-testmetest` suffix npm slug family catalogued across the 2026-10-22, 2026-10-25 (`event-bus-lite-testmetest`), 2026-10-26 (`path-stream-utils-testmetest`), and prior sweeps is **the same operator** per today`s OSSF-and-SafeDep cross-attribution. The 2026-10-25 `event-bus-lite-testmetest@0.0.6` Bun-runtime binding.gyp loader (payload hash `e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73`, confirmed Brotli + AES-128-GCM encrypted Bun payload under the TanStack / Mini Shai-Hulud TTP family) is now the strongest-published-sample reference for what the npm side of this family deploys.

## Classification

`malicious-package`. Severity `critical` - this is a **confirmed self-propagating credential-stealing worm with destructive-actions trigger** on a package whose only reach is anyone who installs the typosquat slug, but every host that resolved it is **fully compromised** at import time plus has a live backdoor plus will be wiped on credential rotation. The combination of worm propagation (makes blast radius unbounded in dependency chains that pin maintainer identities rather than slugs) and conditional-wiper destructive actions (makes incident response itself the detonation trigger) is why this clears the `critical` threshold even though no legitimate widely-used PyPI package was hijacked today.

## Impact

- **Install-time persistence via Python `.pth` hook** - the package writes a `.pth` file into the site-packages directory, which Python evaluates automatically on every interpreter startup. The hook runs an obfuscated JavaScript stage under the Bun runtime (downloaded at runtime, not Node). This is the PyPI analogue of the Miasma-family npm `binding.gyp` + Bun-runtime loader pattern first captured by StepSecurity / SafeDep / JFrog on the June 2026 `@redhat-cloud-services` and Leo Platform compromises - a persistence primitive that fires on **every Python invocation**, not just on `python -m <pkg>` or `import <pkg>`
- **Credential sweep** (OSSF reason tags `infostealer` + `exfiltration-credentials`) - the Miasma payload family harvests AWS (IMDS, Secrets Manager, SSM, ECS task-role), GCP (metadata, service-account keys), Azure (managed identity, Key Vault, federated creds), HashiCorp Vault (probes 10+ token-file locations), Kubernetes SA tokens, npm / PyPI / RubyGems / JFrog publish tokens, GitHub PATs (especially `gh` CLI configs), shell history, env variables, and 1Password session tokens. The pystr-codec sample`s exact harvester list is not published on the GHSA page but OSSF tags `exfiltration-credentials` and the shared Miasma family attribution make the standard family sweep the operating assumption until a per-sample analysis lands
- **Backdoor + remote-command execution** (OSSF reason tags `backdoor` + `persistence`) - after the initial exfil the implant awaits remote commands from the operator, so any host that imported the module during the 0.1.0 - 0.1.2 window must be treated as having had a live attacker channel, not just a point-in-time credential leak
- **Worm propagation** (OSSF reason tag `worm`) - the Miasma family self-spreads by using harvested npm publish tokens to call npm`s automation-token `bypass_2fa` API and publish fresh malicious versions to every package the victim can write to. The PyPI equivalent uses harvested PyPI API tokens the same way; any PyPI publish token found on the host is assumed to have been used to republish wave-N variants under the maintainer`s own name
- **Destructive actions on credential invalidation** (OSSF reason tag `destructive-actions`) - the implant periodically re-checks whether the harvested credentials are still valid. Once a credential it holds is invalidated (rotation, revocation, account closure) the local-machine destructive sequence runs - this is a wiper trigger explicitly conditioned on the defender`s *remediation action*, so hasty credential rotation on an exposed host can itself cause the wipe. Image the host for forensics BEFORE rotating any credential
- **Exfiltration channel** - OSSF publishes two IOCs on the pystr-codec sample: domain `paleasbest.top` and URL `https://paleasbest.top/v1/api`. The Miasma family additionally commits exfil envelopes to an attacker-controlled public GitHub repository (dead-drop channel using the victim`s own GitHub token). Watch for both outbound HTTPS to `paleasbest.top` and anomalous commits/repo-creates authored by the installing host`s GitHub identity
- **Alias / family linkage** - OSSF`s pystr-codec record cites the SafeDep write-up [testmetest npm worm, Miasma variant](https://safedep.io/testmetest-npm-worm-miasma-variant/), tying the npm `*-testmetest` slug suffix family (`sdk-utils-testmetest`, `kvarzo8f3atestmetest` on 2026-10-22; `event-bus-lite-testmetest@0.0.6` on 2026-10-25 with confirmed Bun loader; `path-stream-utils-testmetest` on 2026-10-26; and the broader 2026-10-22 npm batch `net-codec-testmetest`, `log-rotate-testmetest`, `pixel-map-testmetest`, `event-emitter-testmetest`, `log-sink-testmetest`, `test-brotli-testmetest`, `test-brotli2-testmetest`, `data-pipeline-testmetest`) to this same operator / tool family. The prior catalogue entries treated those npm testmetest slugs as "research / canary" artefacts - today`s pystr-codec attribution upgrades the family to **confirmed Miasma variant**

## What to do

1. **Immediate remediation** - grep every `requirements.txt`, `Pipfile`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, Dockerfile, container-image manifest, and sandbox lockfile for the exact slug `pystr-codec` and the exact versions `0.1.0`, `0.1.1`, `0.1.2`. On any hit assume full-host compromise: pull the host off network, image for forensics BEFORE rotating any credential (the implant`s destructive path triggers on credential invalidation, so rotating first can detonate the wiper on the still-running agent)
2. **Then rotate every credential reachable from the host** - AWS access keys + ECS task role + Secrets Manager / SSM / Parameter Store entries; GCP service-account keys; Azure managed-identity tokens; Kubernetes SA tokens; Vault tokens; npm publish tokens (automation and classic); PyPI API tokens; RubyGems / JFrog tokens; GitHub PATs (especially long-lived `gh` CLI tokens, SSH keys with `~/.gitconfig` credential helpers); 1Password session tokens; shell-history-captured secrets
3. **Audit PyPI publish history** - if any PyPI API token on the compromised host had publish rights to legitimate packages, assume Miasma`s self-spread step published malicious wave-N versions under that maintainer`s identity. Enumerate every PyPI project the host`s token could write to and audit publish timestamps for the last 7 days against the maintainer`s expected release cadence; yank anything out of band
4. **Audit GitHub for exfil dead-drops** - the Miasma family commits exfil envelopes to attacker-controlled or victim-shadow repositories using the victim`s own GitHub token. Enumerate every repository created, forked, or committed to under the exposed GitHub identity in the last 7 days; delete attacker-created repos and revoke any PAT the host held
5. **Egress block** - add `paleasbest.top` apex (and the `https://paleasbest.top/v1/api` path) to the organisation-wide egress denylist. Carry forward the Miasma family IOCs already in the standing denylist from the June 2026 Leo Platform / `@redhat-cloud-services` sweeps (Bun-1.3.13-linux-x64.zip, `/tmp/p.js` toolkit path, dead-drop GitHub commit shape)
6. **Add file-integrity alerts** - watch build-runner hosts for new `.pth` files appearing under any site-packages directory, and watch for the Bun runtime binary appearing on hosts that do not normally use Bun. Both are strong Miasma family signals on PyPI (the `.pth` hook is the PyPI equivalent of the npm `binding.gyp` trick)
7. **Family watch** - continue to treat any npm or PyPI slug carrying the `-testmetest` suffix (or the `testmetest` substring) as part of this operator family until the campaign stops iterating. Add the bare `-testmetest` suffix as a prefix-wildcard watch on both npm and PyPI mirrors if operational posture allows

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-f93h-mc69-274w - PyPI pystr-codec Miasma worm variant](https://github.com/advisories/GHSA-f93h-mc69-274w) - GitHub
- [OSSF malicious-packages MAL-2026-18432 (pystr-codec OSV record, campaign 2026-11-pystr-codec, kam193 analysis)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pystr-codec/MAL-2026-18432.json) - OpenSSF
- [DependencyWatch: Leo Platform maintainer account hijacked, 20 npm packages backdoored (June 2026 Miasma Shai-Hulud Hades reference incident with full payload analysis)](https://dependencywatch.io/incident/npm-2026-06-24-leo-platform-miasma-hades)
- [DependencyWatch: Miasma worm hits @redhat-cloud-services (June 2026 original Miasma npm wave)](https://dependencywatch.io/incident/npm-2026-06-01-miasma-redhat-cloud-services)
- [DependencyWatch: multi-2026-10-26-ghsa-malware-sweep (event-bus-lite-testmetest Bun-runtime binding.gyp loader, strongest-published npm testmetest sample, MAL-2026-18292)](https://dependencywatch.io/incident/multi-2026-10-26-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-23-ghsa-malware-sweep (original 2026-10-22 npm *-testmetest cluster: sdk-utils, kvarzo8f3a + sibling batch)](https://dependencywatch.io/incident/multi-2026-10-23-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-27-ghsa-malware-sweep (path-stream-utils-testmetest npm sibling)](https://dependencywatch.io/incident/multi-2026-10-27-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm
Markdown version: https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).