PYSEC-2026-1075

PYSEC-2026-1075 · Malicious code in tiktoken-mcp (PyPI)

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of tiktoken-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload (via the Bun runtime) on import that harvests and exfiltrates credentials and attempts self-propagation. This entry is a summary; behavior may not be fully characterized here. See the linked references for detailed analysis and indicators of compromise.

Опубликовано

2026-07-07T16:26:46Z

Обновлено

2026-07-07T17:00:05.698089145Z

Стек: python

Проверьте свой сервер →