Shai-Hulud Hades Campaign Poisoned 19 PyPI Packages to Steal Developer Secrets

Researchers reported that the Hades malware campaign, tied to the broader Shai-Hulud/Miasma lineage, poisoned 19 PyPI packages across 37 malicious releases, including widely used bioinformatics and science-focused tools. The malicious packages abused Python startup and import mechanisms such as executable .pth files and obfuscated __init__.py hooks to automatically fetch the Bun JavaScript runtime from GitHub and launch an obfuscated stealer payload, often without requiring normal package execution. Investigators said the malware harvested a broad set of secrets from developer workstations and CI/CD environments, including GitHub, npm, PyPI, cloud, Kubernetes, SSH, Docker, and shell-history credentials, while using GitHub repositories, GitHub Actions, and secondary HTTPS channels for exfiltration.

Security firms said the operation expands earlier Shai-Hulud tradecraft with AI-analysis evasion, hidden prompts intended to mislead LLM-based security tools, payload retrieval from GitHub commits, SSH/SCP-based lateral movement, IDE and AI-assistant backdooring, and destructive components such as a gh-token-monitor service. Reporting also linked the campaign to an attempted compromise of the Pythagora-io/gpt-pilot project after the maintainer account LeonOstrez was breached, although the malicious changes reportedly failed CI checks because formatting and linting rules blocked them. Defenders were urged to rotate exposed secrets, restore from trusted backups, and hunt for indicators including executable .pth files, Bun downloads from GitHub, and unusual Python-to-Bun process chains on Linux and macOS systems.