{"action":"Upgrade pantheon-agents to 0.6.4 or later.","affected":[{"fixed":"0.6.4","introduced":"0.6.1"}],"component":"pantheon-agents","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.6.4"],"ghsa_id":"GHSA-93qj-5q5v-3c2h","id":"tcs_01M5KF9N3G1M6FV9P8R34059WK","modified_at":"2026-08-26T14:45:10.471761254Z","published_at":"2026-08-26T14:36:45Z","references":["https://osv.dev/vulnerability/GHSA-93qj-5q5v-3c2h","https://github.com/aristoteleo/PantheonOS/security/advisories/GHSA-93qj-5q5v-3c2h","https://github.com/aristoteleo/PantheonOS"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-93qj-5q5v-3c2h","url":"https://osv.dev/vulnerability/GHSA-93qj-5q5v-3c2h"}],"summary":"Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)"}