Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack Mini Shai-Hulud / Miasma lineage. The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI. Only th...

PYSEC-2026-607 Malicious code in pantheon-agents (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of pantheon-agents were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...

pantheon-cli (>=0.1.1, <=0.1.4) potentially affected by unknown CVE via pantheon-agents (0.6.4)

pantheon-agents PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pantheon-agents and may be impacted: - pantheon-cli =0.1.1, =0.1.4 Source cves: unknown CVE Source advisory: SNYK:PYTHON-PANTHEONAGENTS-17220146...

magique-ai (>=0.1.0, <=0.4.3), pantheon-agents (>=0.3.0, <=0.3.3) +2 more potentially affected by unknown CVE via magique (0.6.7)

magique PYPI version 0.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on magique and may be impacted: - magique-ai =0.1.0, =0.3.0, =0.1.1, =0.5.0, =0.5.4 Source cves: unknown CVE Source advisory: SNYK:PYTHON-MAGIQUE-17220140...

pantheon-agents (>=0.3.0, <=0.3.3), pantheon-cli (>=0.1.1, <=0.1.4) potentially affected by unknown CVE via pantheon-toolsets (0.5.4)

pantheon-toolsets PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on pantheon-toolsets and may be impacted: - pantheon-agents =0.3.0, =0.1.1, =0.1.4 Source cves: unknown CVE Source advisory: SNYK:PYTHON-PANTHEONTOOLSETS-17220147...

MAL-2026-5299 Malicious code in pantheon-agents (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ee06d7aabbdf76969119c2f986e18bbc7f0dcac59ae9cae4f7a04798f2d083d The package installs pantheonagents-setup.pth into site-packages, which Python auto-executes at every interpreter startup broader than import-time,...