Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth Startup Hook to Launch Bun-Powered Credential Stealer — Threadlinqs Intelligence
As of 2026-06-07, Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth Startup Hook to Launch Bun-Powered Credential Stealer is a critical-severity supply chain threat attributed to Shai-Hulud, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0709 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Shai-Hulud · FINANCIAL
Socket identified a new PyPI wave of the self-propagating Shai-Hulud/Miasma supply-chain worm on June 7, 2026: 37 malicious wheel artifacts across 19 packages ship a *-setup.pth startup hook that
On June 7, 2026, the Socket Research Team disclosed a new PyPI wave of the Shai-Hulud/Miasma self-propagating supply-chain worm, branded 'Hades' for its Python iteration. The wave comprises 37 malicious wheel artifacts across 19 PyPI projects — heavily skewed toward bioinformatics and genomics tooling (dynamo-release, spateo-release, coolbox, ufish, napari-ufish, mrbios) alongside developer-automation libraries (executor-engine, executor-http, funcdesc, cmd2func, pantheon-agents, pantheon-toolsets, magique, magique-ai). The campaign was initially flagged by incident responder 'boredchilada' on Bluesky and attributed to the Mini Shai-Hulud/Miasma lineage previously responsible for the Red Hat Cloud Services npm compromise (June 1, 2026) and the TeamPCP source-code release (May 12, 2026).
Execution chain: Each malicious wheel contains a *-setup.pth file holding a single executable Python line. Python's site module processes .pth files during interpreter startup and executes any line beginning with 'import' followed by whitespace, so the loader runs automatically the next time the interpreter launches in the affected environment — no explicit import of the package is required. The .pth loader (SHA256 c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c, identical across all 37 artifacts) creates a sentinel file .bun_ran in the temp directory, locates the bundled _index.js payload, and — if Bun is not already cached — downloads Bun v1.3.13 from the legitimate GitHub releases endpoint (github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-{os}-{arch}.zip) using urllib.request.urlretrieve(). It extracts the runtime to tempdir/b/bun and executes the payload via subprocess.run([bun, 'run', payload]). Using Bun — a non-standard runtime for a Python payload — is itself a fingerprint tying this wave to the npm-origin Shai-Hulud family.
Stealer: The _index.js payload exists in two obfuscated variants (SHA256 dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efe, ~4.8 MB, across 17 packages; and e1342a80d4b5e83d2c7c22e1e0aaa95f2d88e3dbf0d853a4994b180c93a4b17d, ~4.7 MB, across 2 packages). Obfuscation layers include character-code decoding, ROT-style alphabet substitution, AES-128-GCM and AES-256-GCM encryption, PBKDF2/SHA256 string decoding, and gzip compression. The stealer enumerates and harvests: GitHub credentials, Actions secrets, runner memory and ghs_* tokens; npm, PyPI, RubyGems, JFrog, CircleCI tokens; Anthropic API tokens; AWS credentials, STS identity, SSM Parameter Store and Secrets Manager; GCP identity/projects and Secret Manager; Azure identity and Key Vault; Kubernetes service-account tokens; SSH keys, Docker configs, Git credentials; .env, .npmrc, .pypirc files; shell histories; Claude/MCP configs; Vault tokens and wallet/application data.
Exfiltration: The primary channel creates public repositories via the GitHub API (POST /user/repos) to store encrypted/compressed credential dumps under results/results-<timestamp>-<counter>.json. Exfil repos carry the marker description 'Hades - The End for the Damned', use commit messages containing 'IfYouYankThisTokenItWillNukeTheComputerOfTheOwnerFully', and draw randomized names from a mythological word pool (stygian, tartarean, cerberus, charon, styx, lethe, thanatos, persephone). A secondary channel uses GitHub Actions artifact exfiltration via a workflow named 'Run Copilot' uploading an artifact 'format-results' (file format-results.txt). A tertiary set of HTTPS requests to api.anthropic.com/v1/api:443 is assessed as network-log camouflage rather than functional exfil (the path returns 404).
Self-propagation and persistence: As a worm in the Shai-Hulud lineage, stolen package-registry tokens (npm, PyPI) enable downstream re-publishing to additional packages. Recovered persistence and follow-on artifacts target developer-automation and AI-assisted coding environments: ~/.config/gh-token-monitor/, ~/.local/bin/gh-token-monitor.sh, ~/.config/systemd/use
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-522, CWE-912
Target sectors: technology, software-development, bioinformatics, genomics, academia-research, ci-cd-devops, cloud-services
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1586, T1195.001, T1059.006, T1059.007, T1037, T1543.002, T1543.001, T1546, T1027, T1497.001