Security Digest · Critical advisory (no CVE assigned)
GHSA-93qj-5q5v-3c2h: Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack (Mini Shai-Hulud / Miasma lineage).
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
pip-audit (or: pip show <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | pantheon-agents | >= 0.6.1, <= 0.6.2 | 0.6.4 |
Details
Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack (Mini Shai-Hulud / Miasma lineage). The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI.
Only the PyPI artifacts are affected. The GitHub source repository, its git tags, and all other distribution channels are clean — no malicious code was committed to the repository.
Affected - pantheon-agents 0.6.1 and 0.6.2 on PyPI.
Not affected: installs from the GitHub source, version 0.6.0 and earlier, and the Desktop / Online apps.
Indicators of compromise The malicious wheels ship a -setup.pth file that executes on Python startup. It downloads the Bun JavaScript runtime and runs an obfuscated credential stealer (index.js) that harvests and exfiltrates credentials reachable from the host — environment variables, ~/.pypirc, ~/.npmrc, cloud credentials (~/.aws, etc.), SSH keys, and API tokens.
Check your environment's site-packages for an unexpected -setup.pth, and your home directory for index.js or a Bun runtime (~/.bun).
Impact Anyone who pip installed pantheon-agents 0.6.1 or 0.6.2 should assume every credential present on that machine has been exfiltrated.
Remediation 1. Do not install pantheon-agents from PyPI until distribution resumes. 2. If you installed 0.6.1 or 0.6.2: - Run pip uninstall pantheon-agents immediately and check for the IoCs above. - Rotate every credential that was present on that machine (API keys, tokens, SSH keys, cloud credentials). 3. Install only from the clean GitHub source:
Sources and references
- GitHub Advisory GHSA-93qj-5q5v-3c2h github.com
- github.com github.com