The 'magique' PyPI package versions 0.6.8 and 0.6.9 were compromised to include an obfuscated JavaScript infostealer executed with the Bun runtime at Python startup. This malware collects a wide range of sensitive information such as environment variables, cloud tokens, credentials, and cryptocurrency data. It actively queries online services to gather additional secrets and attempts to maintain persistence and spread by publishing infected packages using stolen credentials. Data exfiltration is likely conducted via GitHub. The malicious code also includes destructive capabilities, threatening to wipe user data if invalid GitHub tokens are detected. The campaign is associated with the Mini Shai Hulud threat actor group and employs sandbox evasion techniques.

Users of 'magique' versions 0.6.8 and 0.6.9 risk exposure of sensitive information including API keys, credentials for package repositories, cryptocurrency assets, and password manager data. The malware's persistence and propagation mechanisms increase the risk of further infections and supply chain compromise. Data exfiltration through GitHub can lead to widespread credential leakage. The destructive payload may result in data loss if triggered. Overall, this represents a significant compromise of confidentiality, integrity, and availability for affected users.

No official patch or remediation is currently documented. Users should immediately discontinue use of 'magique' versions 0.6.8 and 0.6.9. Conduct thorough system and environment scans for the presence of the malicious code and related artifacts. Exercise extreme caution during cleanup due to the destructive potential of the malware. Review and rotate all potentially exposed credentials, API keys, and tokens. Monitor for unauthorized package publishing activity in repositories. Follow updates from the package maintainers or PyPI security teams for any official advisories or fixes. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for current remediation guidance.