Socket identified a coordinated PyPI supply-chain compromise with 37 malicious wheel artifacts across 19 packages, using a *-setup.pth startup hook to launch a Bun-based JavaScript stealer named _index.js. The campaign is a PyPI branch of the Shai-Hulud/Miasma lineage that steals developer and CI/CD secrets, exfiltrates to GitHub, and uses markers such as Hades – The End for the Damned. #PyPI #ShaiHulud #Miasma #Bun #Hades
Keypoints
- Socket detected 37 malicious PyPI wheel artifacts spread across 19 packages.
- The compromised releases used a *-setup.pth file to execute code automatically during Python startup.
- The startup hook downloaded the Bun runtime from GitHub and ran an obfuscated JavaScript payload named _index.js.
- The tradecraft matches the Shai-Hulud / Miasma family, including cross-runtime execution and Bun bootstrapping.
- The payload targets developer and CI/CD credentials such as GitHub, npm, PyPI, AWS, GCP, Azure, Kubernetes, Vault, SSH keys, and Docker configs.
- GitHub was used for exfiltration and propagation, including public repository creation, artifact uploads, and workflow abuse.
- The affected PyPI packages included widely used research tools such as dynamo-release, spateo-release, coolbox, ufish, and napari-ufish.
MITRE Techniques
- [T1195 ] Supply Chain Compromise – The attacker compromised trusted PyPI packages to deliver malicious wheels to users (‘coordinated PyPI compromise involving 37 malicious wheel artifacts across 19 packages’).
- [T1059.007 ] JavaScript – The payload runs as obfuscated JavaScript under Bun (‘run an obfuscated JavaScript payload named _index.js’).
- [T1059.006 ] Python – A malicious .pth startup hook executes automatically when Python starts (‘Python’s site module processes .pth files during interpreter startup’).
- [T1105 ] Ingress Tool Transfer – The loader downloads the Bun runtime from GitHub before executing the payload (‘download Bun v1.3.13 from GitHub’).
- [T1204 ] User Execution – Execution is triggered when Python starts and processes the installed package files (‘the next python, pip, test run, notebook kernel, CI job… may process the malicious .pth’).
- [T1027 ] Obfuscated Files or Information – The JavaScript payload is heavily obfuscated using eval wrappers, ROT-style decoding, and encrypted stages (‘character-code and ROT-style eval wrapper, AES-GCM encrypted stages’).
- [T1102 ] Web Service – The campaign uses GitHub and an Anthropic API host as remote infrastructure for exfiltration/camouflage (‘GitHub-centric exfiltration’ and ‘traffic to a ubiquitous AI-vendor host’).
- [T1588.001 ] Obtain Capabilities: Credentials from Password Stores – The payload targets local secrets and stored credentials (‘SSH keys, Docker configs, shell histories, .env files, .npmrc, .pypirc’).
- [T1555 ] Credentials from Password Stores – It hunts for developer and cloud credentials from local files and tools (‘GitHub, npm, PyPI, RubyGems, JFrog, CircleCI… credentials’).
Indicators of Compromise
- [PyPI package names ] Malicious packages observed in the campaign – bramin, cmd2func, coolbox, dynamo-release, executor-engine, executor-http, funcdesc, magique, magique-ai, mrbios, napari-ufish, nucbox, okite, pantheon-agents, pantheon-toolsets, spateo-release, synago, ufish, uprobe
- [Package versions ] Compromised release versions – [email protected], [email protected], [email protected], [email protected], [email protected], and 31 more versions
- [File names ] Malicious wheel contents and loader files – *-setup.pth, _index.js, format-results.txt, format-results
- [SHA256 hashes ] Known artifact hashes – c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c, dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efe, and 1 more hash
- [Domains/URLs ] Runtime download and exfiltration infrastructure – github.com/oven-sh/bun/releases/download/bun-v1.3.13, api.anthropic.com/v1/api
- [Paths ] Sentinel and persistence-related paths – /tmp/.bun_ran, /tmp/b.zip, /tmp/b/bun, ~/.config/gh-token-monitor/, ~/.local/bin/gh-token-monitor.sh
- [Repository/workflow markers ] GitHub exfiltration markers and workflow names – Hades – The End for the Damned, IfYouYankThisTokenItWillNukeTheComputerOfTheOwnerFully, Run Copilot, results/results-*.json
Read more: https://socket.dev/blog/shai-hulud-descends-to-hades-miasma-pypi-wave