Уязвимости pantheon-agents

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

## Summary The PyPI account that publishes `pantheon-agents` was compromised in the June 2026 "Hades" PyPI supply-chain attack (Mini Shai-Hulud / Miasma lineage). The attacker used a stolen, long-lived PyPI API token to upload **trojanized releases `pantheon-agents` 0.6.1 and 0.6.2 directly to PyPI**. **Only the PyPI artifacts are affected.** The GitHub source repository, its git tags, and all other distribution channels are clean — no malicious code was committed to the repository. ## Affected - `pantheon-agents` **0.6.1** and **0.6.2** on PyPI. Not affected: installs from the GitHub source, version 0.6.0 and earlier, and the Desktop / On

• Обновитесь до 0.6.4

Malicious code in pantheon-agents (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of pantheon-agents were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload (via the Bun runtime) on import that harvests and exfiltrates credentials and attempts self-propagation. This entry is a summary; behavior may not be fully characterized here. See the linked references for detailed analysis and indicators of compromise.