Executive brief
The PyPI account publishing the pantheon-agents Python library was compromised, allowing attackers to upload trojanized versions 0.6.1 and 0.6.2 containing a credential harvester. When installed, the malicious package executes code on Python startup that downloads a JavaScript-based stealer to exfiltrate all credentials on the system—including API tokens, SSH keys, cloud credentials, and PyPI/npm credentials—creating a complete account takeover risk for affected users.
Technical details
This is a supply-chain attack targeting the PyPI repository. An attacker compromised the maintainer's PyPI account using a stolen long-lived API token and uploaded malicious wheel distributions directly to PyPI. The trojanized packages contain a `*-setup.pth` file that executes arbitrary Python code at package load time (before any user code runs), bypassing typical code review. The payload downloads the Bun JavaScript runtime and executes an obfuscated credential stealer (`_index.js`) that harvests credentials from environment variables, `~/.pypirc`, `~/.npmrc`, `~/.aws`, `~/.ssh`, and other standard credential locations, then exfiltrates them to an attacker-controlled server. Affected versions are 0.6.1 and 0.6.2 on PyPI only; the GitHub source repository, prior versions, and alternative distribution channels remain clean. The attacker achieved complete credential compromise on all systems that installed these versions via pip.
Affected products
- arisotle/PantheonOS pantheon-agents 0.6.1, 0.6.2
Timeline
- 2026-06-15: disclosed
- 2026-08-26: advisory: Advisory published to GitHub Advisory Database