GCVE-110-OSM-2026-14377

Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting remote commands, attempts spreading using discovered credentials as well as periodically checks if discovered credentials are valid. Once they are invalidated, it performs destructive actions on the local machine. It seems to be part of the Miasma-family worm (also known under testmetest). The recovered payload is a credential-stealing/exfiltration framework with repository-creation and upload logic, GitHub/GitLab token handling, cloud credential discovery, and fallback senders. Payload: pystr_codec-setup.pth - which then automatically runs the pystr_codec/ci.js which is the MIasma/testmetest variant worm.