PYSEC-2026-231 Malicious code in embiggen (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of embiggen were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

grape (0.2.5), neat-ml (0.1.0) potentially affected by unknown CVE via embiggen (0.11.96)

embiggen PYPI version 0.11.96 is affected by a known vulnerability. The following packages have a transitive dependency on embiggen and may be impacted: - grape 0.2.5 - neat-ml 0.1.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-EMBIGGEN-17230566...

claude-code-indexer (>=1.0.1, <=1.29.1), embiggen (0.11.96) +2 more potentially affected by unknown CVE via ensmallen (0.8.100)

ensmallen PYPI version 0.8.100 is affected by a known vulnerability. The following packages have a transitive dependency on ensmallen and may be impacted: - claude-code-indexer =1.0.1, =1.29.1 - embiggen 0.11.96 - grape 0.2.5 - neat-ml 0.1.0 Source cves: unknown CVE Source advisory:...