GHSA-93QJ-5Q5V-3C2H: Embedded Malicious Code in pantheon-agents PyPI Packages

In June 2026, threat actors executed a coordinated PyPI supply-chain distribution campaign designated as the Hades campaign. This activity is technically associated with the Mini Shai-Hulud and Miasma malware lineages. The primary objective of the campaign was the compromise of package developer publishing credentials to inject malicious code into downstream software environments.\n\nThe target package in this incident was pantheon-agents, a client-side agent framework belonging to the PantheonOS ecosystem. The threat actor did not compromise the underlying GitHub source repository. Instead, the actor obtained and utilized a compromised long-lived PyPI API token associated with the project maintainer. This permitted direct package distribution manipulation via the standard Python Package Index API, bypassing Git-based source controls and automated repository security scanning.

The entry point for the malicious code execution is not a vulnerability in the software itself, but rather the exploitation of Python path configuration files. These files use the .pth extension and are designed to allow developers to add custom directories to the Python sys.path list during interpreter initialization.\n\nThe Python standard library site module automatically parses all .pth files located within the site-packages directory upon startup. If a line in a .pth file begins with the import statement, the site module executes the remaining code on that line. The threat actor took advantage of this behavior by packing a custom *-setup.pth file inside the compiled wheel files for pantheon-agents versions 0.6.1 and 0.6.2.\n\nThis delivery mechanism ensures execution of arbitrary Python code immediately upon any startup of the Python interpreter, requiring no explicit invocation of the pantheon-agents library by the user or dependent software. This represents a highly reliable method for achieving local persistence and automated execution inside target development and CI/CD environments.

The execution flow of the backdoor is divided into two discrete stages to minimize the footprint of Python-specific static analysis signatures.\n\nStage 1 consists of a bootstrapping script embedded within the malicious .pth file. When triggered, this script performs basic network checks and retrieves the Bun JavaScript runtime binary. The script downloads this binary and saves it to a hidden directory in the user home folder, specifically under ~/.bun.\n\nStage 2 shifts execution from Python to the downloaded Bun JavaScript runtime. The bootstrapper writes an obfuscated JavaScript payload named _index.js to the user home directory and invokes it using Bun. The usage of an external runtime and an obfuscated script is typical of the Miasma lineage, which uses JavaScript-based obfuscation engines to make behavioral sandboxing and traditional signature-based detection difficult.

Once active, the index.js payload executes systemic directory traversals and commands to locate sensitive configuration files and system credentials. The script targets specific developer tools and cloud infrastructure components.\n\nThe payload retrieves all environment variables from process.env, which frequently contain database credentials, cloud access tokens, and API secret keys. Additionally, the script targets and parses specific files in the user's home directory. This includes ~/.pypirc for Python package registry credentials, ~/.npmrc for npm authentication tokens, ~/.aws/credentials for AWS access keys, and cloud CLI configuration directories for Azure and Google Cloud.\n\nFurthermore, the malware scans for SSH private keys within ~/.ssh/id* and general SaaS API tokens. The gathered credential assets are structured, serialized, and exfiltrated over outbound HTTP POST requests to a hardcoded command-and-control server. The exfiltration occurs immediately after package installation, indicating a high level of operational preparation by the threat actor.

The impact of installing the compromised pantheon-agents packages is critical, leading to complete credential compromise of the target system. Because the payload runs with the privileges of the executing user, any credential readable by that user is harvested and exfiltrated.\n\nThis technique is categorized under CWE-506 (Embedded Malicious Code) and CWE-522 (Insufficiently Protected Credentials). The compromise of PyPI and npm credentials allows the threat actor to pivot laterally, potentially targeting other packages maintained by the same developer. This creates a cascading supply-chain threat vector affecting multiple downstream ecosystems.\n\nIn addition, the exfiltration of AWS, Azure, and Google Cloud credentials can lead to unauthorized infrastructure access, data breaches, and resource abuse. Because the compromise occurred solely on the PyPI package index, environments pulling directly from the GitHub repository source code remain unaffected.

Remediation requires immediate uninstallation of the affected package and the cleanup of persistent host artifacts. Organizations must assume that all credentials residing on the infected system have been compromised.\n\nTo remediate, execute pip uninstall pantheon-agents to remove the package. You must also manually inspect the site-packages directory of the active Python environments to verify that no residual *-setup.pth files remain. Delete the downloaded runtime files and the malicious script from the user home folder using standard file deletion commands.\n\nCrucially, all secret keys, cloud credentials, PyPI tokens, and SSH keys that were present on the host must be rotated immediately. To prevent future incidents, package maintainers must adopt PyPI Trusted Publishing using OpenID Connect federation with GitHub Actions. This eliminates long-lived static API tokens, restricting package publishing to short-lived, cryptographically verified workflow sessions.