PYSEC-2026-233 Malicious code in gpsea (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of gpsea were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

Embedded Malicious Code

Overview gpsea is a Python package for finding genotype-phenotype associations. Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that ha...

phenosign (>=0.1.1, <=0.1.5), ppkt2synergy (>=0.0.7, <=0.1.0) potentially affected by unknown CVE via gpsea (>=0.9.8, <=0.9.13)

gpsea PYPI version =0.9.8, =0.1.1, =0.0.7, =0.1.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-GPSEA-17230568...

gpsea (>=0.2.0, <=0.9.11), ppkt2synergy (>=0.0.7, <=0.1.0) potentially affected by unknown CVE via phenopacket-store-toolkit (0.1.6)

phenopacket-store-toolkit PYPI version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on phenopacket-store-toolkit and may be impacted: - gpsea =0.2.0, =0.0.7, =0.1.0 Source cves: unknown CVE Source advisory:...

MAL-2026-5316 Malicious code in gpsea (PyPI)

The package gpsea version 0.9.14 contains a malicious .pth file gpsea-setup.pth that executes a Bun-based credential stealer on every Python startup via CPython's site.py exec mechanism. The payload downloads the Bun runtime from the official GitHub release page, then runs an obfuscated JavaScrip...