Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Summary

The PyPI account that publishes pantheon-agents was compromised in the June 2026 "Hades" PyPI supply-chain attack (Mini Shai-Hulud / Miasma lineage). The attacker used a stolen, long-lived PyPI API token to upload trojanized releases pantheon-agents 0.6.1 and 0.6.2 directly to PyPI.

Only the PyPI artifacts are affected. The GitHub source repository, its git tags, and all other distribution channels are clean — no malicious code was committed to the repository.

Affected

• pantheon-agents 0.6.1 and 0.6.2 on PyPI.

Not affected: installs from the GitHub source, version 0.6.0 and earlier, and the Desktop / Online apps.

Indicators of compromise

The malicious wheels ship a *-setup.pth file that executes on Python startup. It downloads the Bun JavaScript runtime and runs an obfuscated credential stealer (_index.js) that harvests and exfiltrates credentials reachable from the host — environment variables, ~/.pypirc, ~/.npmrc, cloud credentials (~/.aws, etc.), SSH keys, and API tokens.

Check your environment's site-packages for an unexpected *-setup.pth, and your home directory for _index.js or a Bun runtime (~/.bun).

Impact

Anyone who pip installed pantheon-agents 0.6.1 or 0.6.2 should assume every credential present on that machine has been exfiltrated.

Remediation

1. Do not install pantheon-agents from PyPI until distribution resumes.
2. If you installed 0.6.1 or 0.6.2:
   • Run pip uninstall pantheon-agents immediately and check for the IoCs above.
   • Rotate every credential that was present on that machine (API keys, tokens, SSH keys, cloud credentials).
3. Install only from the clean GitHub source: