PT-2026-55187

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of executor-http were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials a...

MAL-2024-12292 Malicious code in instaread (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 792748013463fb0303ff6033b47dcb48c23dc944d5075a8859b6997eafd47a56 The file bc2556d1c1ea2a2d00.js contains an AdWare LNKR, this file is included in readarticle.html template and effectively used when the user requests to see t...