VYPR
← All malware advisories

pypi · Malicious package advisory

Malware

tiktoken-mcp

PYSEC-2026-1075

Malicious code in tiktoken-mcp (PyPI)

Details

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,
malicious phantom releases of tiktoken-mcp were published to PyPI using stolen
credentials. The package executes a bundled JavaScript payload (via the Bun
runtime) on import that harvests and exfiltrates credentials and attempts
self-propagation. This entry is a summary; behavior may not be fully
characterized here. See the linked references for detailed analysis and
indicators of compromise.

Compromised versions (2)

  • 0.13.1
  • 0.13.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.