Trojanized PyPI AI Proxy Uses Stolen Claude Prompt to Exfiltrates Data

A malicious PyPI package named hermes-px posed as a Tor-based AI inference proxy but covertly logged all user prompts, leaked real IP addresses by bypassing Tor, and forwarded stolen data to an attacker-controlled Supabase endpoint; it also contained a near-complete stolen proprietary system prompt and a runtime CLI that allowed remote payload execution. JFrog Security disclosed the campaign on April 5, 2026, and recommended immediate uninstallation, credential rotation, network blocking of the Supabase host, and review of any captured conversations.