The package allegedly uses a .pth startup hook so code can run when an interpreter initializes rather than when the project explicitly imports its functions. The secondary stage reportedly targets developer credentials and paths used by coding agents, including persistent instruction and tool configuration material. This may overlap the Miasma and…
Inspect the ClaimsCase · DiggingBeagle record
pystr-codec PyPI malware uses Python startup hooks in an agent-tool supply-chain campaign
An advisory identifies malicious pystr-codec distributions that trigger payloads from Python startup hooks and reportedly modify coding-agent instruction and tool files.
Agent-enabled software supply-chain attackAgent package lifecycle scripts can persistently rewrite tool and memory authority
Scope
Malicious payload capabilities are reported; real victim count, successful exfiltration and shared attribution with other worms remain unverified.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The OpenSSF malware advisory documents hostile package code and versions; no installation population, confirmed external victim effects or common operator identity follows automatically from that listing. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-PYSTR-CODEC-AGENT-WORM-A · GitHub Advisory GHSA-f93h-mc69-274w, malicious pystr-codec
At a glance
Developer package execution can become agent instruction persistence; package removal does not prove earlier credentials or workspace state are clean.
Read the implicationsMalicious payload capabilities are reported; real victim count, successful exfiltration and shared attribution with other worms remain unverified. There is no patched version in the advisory; installed population, transfer logs and confirmed common authorship with related worms are unknown.
Limits and uncertaintyFull account
The package allegedly uses a .pth startup hook so code can run when an interpreter initializes rather than when the project explicitly imports its functions. The secondary stage reportedly targets developer credentials and paths used by coding agents, including persistent instruction and tool configuration material. This may overlap the Miasma and testmetest ecosystem, but a shared actor or actual worm spread cannot be inferred from the advisory alone. The older agent-hook Case describes a separate set of compromised repositories.
This package does not require a user to import its advertised API after installation to affect later runs: the malicious .pth hook can execute on interpreter startup. The OpenSSF advisory identifies versions 0.1.0, 0.1.1 and 0.1.2 and describes a secondary Bun routine with credential theft and propagation logic. Its suspected relationship to the testmetest or Miasma family is an attribution hypothesis based on implementation overlap, not evidence of one controlling actor. Presence of the package establishes a severe exposure condition, but installed-host prevalence and successful exfiltration remain unknown.
Mechanism and trust boundary
- 01
Install hostile Python distribution
The package places a startup hook in interpreter-visible paths.
Boundary: Dependency installation into Python process startup
- 02
Run secondary payload
The hook launches an obfuscated Bun-stage routine intended to harvest credentials.
Boundary: Python interpreter startup into arbitrary code
- 03
Modify agent surfaces
Reported payload logic targets tools or instruction files that future agent sessions may consume.
Boundary: Compromised host into persistent agent workflow
Claims & evidence
CLM-2026-NOV02-PYSTR-CODEC-AGENT-WORM-AGHSA-f93h-mc69-274w identifies pystr-codec versions 0.1.0, 0.1.1 and 0.1.2 as malicious, with Python startup execution and a secondary JavaScript/Bun payload intended to harvest credentials and propagate.supported
Basis: reported finding
- supportsGitHub Advisory GHSA-f93h-mc69-274w, malicious pystr-codecprimary disclosure
GitHub malware advisory, package versions and payload summary
Implications
Developer package execution can become agent instruction persistence; package removal does not prove earlier credentials or workspace state are clean.
Controls and mitigations
- Quarantine installed distributions, inspect .pth files and agent instruction/configuration diffs, rotate exposed credentials and audit external transfers.
- Remove the hostile distribution and interpreter startup files, inspect agent instruction changes and rotate any credentials available to that interpreter environment.
Unknowns and contradictions
- Malicious payload capabilities are reported; real victim count, successful exfiltration and shared attribution with other worms remain unverified.
- There is no patched version in the advisory; installed population, transfer logs and confirmed common authorship with related worms are unknown.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214