19 PyPI packages compromised in Hades attack

The source describes a PyPI software supply-chain attack named Hades in which 19 packages and 37 malicious wheel artifacts were compromised. The packages contained code that executes during Python startup or package import, downloads the Bun JavaScript runtime, and runs a JavaScript credential stealer.