pypi package report

Is pantheon-toolsets safe?

Versions 0.5.6 and 0.5.5 of pantheon-toolsets were compromised (Multi-signal supply-chain anomaly (cross-signal auto)). Other versions are not flagged as malicious.

Do not install pantheon-toolsets 0.5.6 or 0.5.5

HIGHanalyst verified

Multi-signal supply-chain anomaly (cross-signal auto). Added to CyberXYZ 2026-06-10, verified by a CyberXYZ analyst.

// what we observed

package contents+10
pickle deserialize of untrusted data
package contents+8
environment-variable read (corroborating; no exfil co-signal)
package contents+45
.pth startup-hook carrying a runnable payload (exec/subprocess/network — persists across releases)
wave member+30
member of campaign wave (script_hash, 19 pkgs, 19 suspicious)

// versions and what to do

Malicious: 0.5.6, 0.5.5
Move to: 0.5.4 newest 0.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

pip install "pantheon-toolsets==0.5.4"

// reach

0 direct dependencies

none carry a known advisory

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

No published models are known to use this package.

Checked 2026-10-30 at 23:59 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.