The mem8 PyPI package version 6.0.1 was compromised to include heavily obfuscated JavaScript infostealer code executed with the Bun runtime on Python startup. The malware collects a wide range of sensitive information including environment variables, cloud tokens, credentials, and cryptocurrency data. It attempts persistence and propagation by publishing infected packages using stolen credentials. Data exfiltration is likely performed through GitHub. The code includes destructive capabilities triggered by invalid GitHub tokens and detects sandbox environments to avoid detection. This incident is associated with the Mini Shai Hulud campaign and is categorized as a malicious package compromise with clear intent to steal information and cause harm.

Users of mem8 version 6.0.1 are at risk of having sensitive information such as API keys, package repository credentials, cryptocurrency assets, and password manager data stolen. The malware can persist on infected systems and spread by publishing additional infected packages. There is also a risk of destructive actions including potential data wiping if certain conditions are met. This compromises confidentiality, integrity, and availability of affected systems and data.

No official patch or fix is currently documented for this compromise. Users should immediately discontinue use of mem8 version 6.0.1 and remove it from their environments. Due to the destructive nature of the malware, cleanup should be performed with caution, ideally by restoring systems from known good backups and rotating all potentially exposed credentials and secrets. Monitor for any suspicious package publishing activity using stolen credentials. Check vendor or repository advisories for updates or remediation guidance.