tiktoken-mcp is a malicious PyPI package that impersonates the legitimate OpenAI tiktoken package by copying metadata and bundling the upstream README. It installs a tiktoken-setup.pth file that executes an obfuscated JavaScript payload using the Bun runtime on Python startup. This payload downloads the Bun runtime, extracts it to a temporary directory, and executes any '_index.js' files found on sys.path, which are attacker-controlled. The package itself does not include these files, enabling runtime-resolved malicious code execution outside Python's inspection. The infostealer collects a wide range of sensitive data including API keys, repository credentials, cryptocurrency assets, and password manager data. It also attempts to gain persistence and spread by publishing infected packages using stolen credentials. The code may wipe user data if invalid GitHub tokens are detected. This campaign is linked to the Mini Shai Hulud campaign and is categorized as a malicious package with clear intent to steal information and cause harm.

This malicious package can lead to severe compromise of affected systems by exfiltrating sensitive information such as API keys, cloud tokens, repository credentials, cryptocurrency assets, and password manager data. It can also execute arbitrary attacker-controlled JavaScript code on Python startup, bypassing Python-only security inspections. The package attempts persistence and propagation by publishing infected packages using stolen credentials. Additionally, it may perform destructive actions including wiping user data if invalid GitHub tokens are detected, posing a risk of data loss.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing tiktoken-mcp versions 0.13.1 and 0.13.2 and to remove any existing installations immediately. Users should verify the authenticity of packages before installation, prefer official sources, and monitor for suspicious activity related to package repositories and credentials. Cleanup should be performed with caution due to potential destructive payloads. Consult vendor advisories or trusted security sources for updates on remediation or detection tools.