The pyphetools package version 0.9.120 on PyPI contains a malicious .pth file that executes a Bun-based JavaScript credential stealer on every Python startup. This malware exfiltrates environment variables, .env files, SSH keys, cloud credentials, and other sensitive data to an attacker-controlled GitHub repository. It is part of the Hades/Miasma campaign attributed to the TeamPCP threat actor and includes obfuscation and sandbox detection techniques. The malicious code may also attempt destructive actions if invalid GitHub tokens are detected.