A compromise has been reported in PyPI, involving a credential stealer written in Python. The malware is described as bun-based, suggesting a connection to the bun JavaScript bundler. The nature and extent of the compromise are not fully detailed in available reports.