published 2026-10-21
Version 0.1.0 of the tessivatts PyPI package is listed in a coordinated campaign of loader packages that run code fetched from a web address. Amazon Inspector found no install-time or import-time harm in the package contents, and the real payload and its use are unknown.
Source: OSV
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1208 and your operating system.