The mflux-streamlit package versions 0.0.3 and 0.0.4 were compromised to include heavily obfuscated JavaScript infostealer code executed through the Bun runtime on Python startup. The malware collects a wide range of sensitive information including environment variables, cloud tokens, credentials, and cryptocurrency data. It attempts to maintain persistence and propagate by publishing infected packages using stolen credentials. The code also detects sandbox environments and may perform destructive actions such as wiping user data if invalid GitHub tokens are found. This campaign is identified as 2026-06-compr-woodpecker and is associated with the Mini Shai Hulud campaign. No official patch or remediation is indicated in the data.

The malicious code compromises confidentiality by stealing sensitive credentials, API keys, and cryptocurrency assets. It threatens data integrity and availability by potentially wiping user data. The malware also risks supply chain security by publishing infected packages using stolen credentials, potentially spreading the infection further. This can lead to widespread credential compromise and data loss for users of the affected package versions.

No official patch or remediation is currently documented. Users should immediately discontinue use of mflux-streamlit versions 0.0.3 and 0.0.4. Remove these versions from environments and replace them with trusted alternatives. Exercise caution during cleanup due to potential destructive payloads. Monitor for unauthorized package publishing activity using compromised credentials. Check vendor advisories or PyPI for updates or official guidance.