Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer
11:13 · June 9, 2026 · Hacker News AI Section
The Miasma supply chain campaign has sparked a fresh attack wave called Hades, this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index (PyPI) registry, as the Mini Shai-Hulud-style attacks continue to be refined and splintered to target specific ecosystems. "The compromised releases shipped a *-setup.pth file that attempts to execute automatically
Summary
A supply chain attack campaign tracked as Hades has placed malicious releases in 19 packages on the Python Package Index, resulting in 37 compromised wheel files. The packages deliver a *-setup.pth file that Python’s site module loads automatically at interpreter startup, allowing the payload to execute without any import by the consuming application. Once active, the code downloads the Bun JavaScript runtime from GitHub, then runs an obfuscated JavaScript stealer named _index.js that harvests credentials and configuration files for GitHub, npm, PyPI, cloud providers, CI/CD services, and local development tools.
The campaign is viewed as a PyPI-specific branch of the earlier Shai-Hulud and Miasma operations rather than an isolated Python incident. Attackers continue to rely on the same core sequence—abusing trusted package channels, staging a Bun-powered JavaScript payload, and exfiltrating data through GitHub repositories—while introducing incremental changes in persistence and evasion. In one cluster of bioinformatics-related packages the entry point is instead placed inside __init__.py as an obfuscated import hook, yet the outcome remains identical: Bun is fetched and the credential stealer is launched.
Additional refinements include a locale check that skips systems set to Russian, memory-scraping routines tailored for macOS and Windows GitHub Actions runners, and plain-text prompt injections intended to mislead LLM-based package scanners. The malware also polls GitHub commits for specific keywords to retrieve further payloads. These tactics illustrate how the same underlying playbook is being adapted across language ecosystems while exploiting the moment between package installation and first code review.
Why it matters
Python is the foundational programming language for AI development. Security professionals in the Dutch AI market must be aware of PyPI supply chain attacks to secure their AI development environments, protect proprietary models, and prevent credential theft.
