Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
cmd2func Package on PyPI Contains Malicious Code
published 4 months ago
Summary
The cmd2func package on the Python Package Index (PyPI) has been compromised with malicious code. This code can steal and send sensitive information, such as login credentials, and attempt to spread to other systems. Update your package manager to ensure you have the latest, trusted version of cmd2func.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| PyPI | weize xu | cmd2func | All versions |
Original advisory text
Malicious code in cmd2func (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,
malicious phantom releases of cmd2func were published to PyPI using stolen
credentials. The package executes a bundled JavaScript payload (via the Bun
runtime) on import that harvests and exfiltrates credentials and attempts
self-propagation. This entry is a summary; behavior may not be fully
characterized here. See the linked references for detailed analysis and
indicators of compromise.
malicious phantom releases of cmd2func were published to PyPI using stolen
credentials. The package executes a bundled JavaScript payload (via the Bun
runtime) on import that harvests and exfiltrates credentials and attempts
self-propagation. This entry is a summary; behavior may not be fully
characterized here. See the linked references for detailed analysis and
indicators of compromise.
References
Timeline
Published29 Jun 2026
Updated29 Jun 2026
First seen29 Jun 2026
Sources
PYSEC-2026-579 · OSV
Track software like this
Free during beta