Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth Startup Hook to Launch Bun-Powered Credential Stealer
Shai-Hulud "Hades" Miasma Worm (TL-2026-0709), also tracked as Hades - The End for the Damned, is a critical-severity supply-chain compromise, first published 2026-06-07. It is attributed to Shai-Hulud with medium confidence, affects PyPI (compromised maintainer) dynamo-release, maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1037), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-0709
- Threat ID
- TL-2026-0709
- Also known as
- Hades - The End for the Damned, Miasma PyPI Wave, Shai-Hulud Hades
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-07
- Last reviewed
- 2026-06-07
- Attribution
- Shai-Hulud
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, bioinformatics, genomics, academia-research, ci-cd-devops, cloud-services
- Target regions
- Global, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Shai-Hulud "Hades" Miasma Worm
Malware and tooling: Miasma
Socket identified a new PyPI wave of the self-propagating Shai-Hulud/Miasma supply-chain worm on June 7, 2026: 37 malicious wheel artifacts across 19 packages ship a *-setup.pth startup hook that auto-executes on Python launch, downloads the Bun runtime from GitHub, and runs an obfuscated _index.js stealer that harvests developer and CI/CD credentials (GitHub, npm, PyPI, AWS, GCP, Azure, Kubernetes, Vault, SSH keys, Docker, Anthropic) and exfiltrates them to attacker-created public GitHub repositories. This PyPI branch self-tags 'Hades - The End for the Damned' and is part of a broader 448-artifact cross-ecosystem campaign.
How Shai-Hulud "Hades" Miasma Worm works
On June 7, 2026, the Socket Research Team disclosed a new PyPI wave of the Shai-Hulud/Miasma self-propagating supply-chain worm, branded 'Hades' for its Python iteration. The wave comprises 37 malicious wheel artifacts across 19 PyPI projects — heavily skewed toward bioinformatics and genomics tooling (dynamo-release, spateo-release, coolbox, ufish, napari-ufish, mrbios) alongside developer-automation libraries (executor-engine, executor-http, funcdesc, cmd2func, pantheon-agents, pantheon-toolsets, magique, magique-ai). The campaign was initially flagged by incident responder 'boredchilada' on Bluesky and attributed to the Mini Shai-Hulud/Miasma lineage previously responsible for the Red Hat Cloud Services npm compromise (June 1, 2026) and the TeamPCP source-code release (May 12, 2026).
Execution chain: Each malicious wheel contains a *-setup.pth file holding a single executable Python line. Python's site module processes .pth files during interpreter startup and executes any line beginning with 'import' followed by whitespace, so the loader runs automatically the next time the interpreter launches in the affected environment — no explicit import of the package is required. The .pth loader (SHA256 c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c, identical across all 37 artifacts) creates a sentinel file .bun_ran in the temp directory, locates the bundled _index.js payload, and — if Bun is not already cached — downloads Bun v1.3.13 from the legitimate GitHub releases endpoint (github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-{os}-{arch}.zip) using urllib.request.urlretrieve(). It extracts the runtime to tempdir/b/bun and executes the payload via subprocess.run([bun, 'run', payload]). Using Bun — a non-standard runtime for a Python payload — is itself a fingerprint tying this wave to the npm-origin Shai-Hulud family.
Stealer: The _index.js payload exists in two obfuscated variants (SHA256 dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efe, ~4.8 MB, across 17 packages; and e1342a80d4b5e83d2c7c22e1e0aaa95f2d88e3dbf0d853a4994b180c93a4b17d, ~4.7 MB, across 2 packages). Obfuscation layers include character-code decoding, ROT-style alphabet substitution, AES-128-GCM and AES-256-GCM encryption, PBKDF2/SHA256 string decoding, and gzip compression. The stealer enumerates and harvests: GitHub credentials, Actions secrets, runner memory and ghs_* tokens; npm, PyPI, RubyGems, JFrog, CircleCI tokens; Anthropic API tokens; AWS credentials, STS identity, SSM Parameter Store and Secrets Manager; GCP identity/projects and Secret Manager; Azure identity and Key Vault; Kubernetes service-account tokens; SSH keys, Docker configs, Git credentials; .env, .npmrc, .pypirc files; shell histories; Claude/MCP configs; Vault tokens and wallet/application data.
Exfiltration: The primary channel creates public repositories via the GitHub API (POST /user/repos) to store encrypted/compressed credential dumps under results/results-<timestamp>-<counter>.json. Exfil repos carry the marker description 'Hades - The End for the Damned', use commit messages containing 'IfYouYankThisTokenItWillNukeTheComputerOfTheOwnerFully', and draw randomized names from a mythological word pool (stygian, tartarean, cerberus, charon, styx, lethe, thanatos, persephone). A secondary channel uses GitHub Actions artifact exfiltration via a workflow named 'Run Copilot' uploading an artifact 'format-results' (file format-results.txt). A tertiary set of HTTPS requests to api.anthropic.com/v1/api:443 is assessed as network-log camouflage rather than functional exfil (the path returns 404).
Self-propagation and persistence: As a worm in the Shai-Hulud lineage, stolen package-registry tokens (npm, PyPI) enable downstream re-publishing to additional packages. Recovered persistence and follow-on artifacts target developer-automation and AI-assisted coding environments: ~/.config/gh-token-monitor/, ~/.local/bin/gh-token-monitor.sh, ~/.config/systemd/user/gh-token-monitor.service, ~/Library/LaunchAgents/com.github.token-monitor.plist, ~/.local/share/updater/update.py, .claude/setup.mjs, .github/setup.js, and .github/workflows/codeql.yml. Evasion logic checks for Russian locale/environment signals, StepSecurity/harden-runner instrumentation, and validates decoy-token prefixes (GitHub, npm, Anthropic, CircleCI, AWS) before acting. Socket tracks 448 total affected artifacts across the campaign: 411 npm artifacts (106 packages) and 37 PyPI artifacts (19 packages).
MITRE ATT&CK techniques used in TL-2026-0709
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks
Persistence
T1037 Boot or Logon Initialization Scripts; T1543.001 Create or Modify System Process: Launch Agent; T1543.002 Create or Modify System Process: Systemd Service; T1546 Event Triggered Execution
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript
Discovery
T1082 System Information Discovery; T1580 Cloud Infrastructure Discovery
Command and Control
T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555 Credentials from Password Stores
Impact
Exfiltration
T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Resource Development
Affected products and versions in Shai-Hulud "Hades" Miasma Worm
- PyPI (compromised maintainer) — dynamo-release
Vulnerable versions: 1.5.4 - PyPI (compromised maintainer) — spateo-release
Vulnerable versions: 1.1.2 - PyPI (compromised maintainer) — coolbox
Vulnerable versions: 0.4.1; 0.4.2 - PyPI (compromised maintainer) — ufish
Vulnerable versions: 0.0.2; 0.0.3 - PyPI (compromised maintainer) — napari-ufish
Vulnerable versions: 0.0.2; 0.0.3 - PyPI (compromised maintainer) — bramin
Vulnerable versions: compromised wheel - PyPI (compromised maintainer) — cmd2func
Vulnerable versions: compromised wheel - PyPI (compromised maintainer) — executor-engine
Vulnerable versions: compromised wheel - PyPI (compromised maintainer) — executor-http
Vulnerable versions: compromised wheel - PyPI (compromised maintainer) — funcdesc
Vulnerable versions: compromised wheel
Remediation for Shai-Hulud "Hades" Miasma Worm
Patches
- Upgrade affected packages to vendor-cleaned versions once republished; until then remove and reinstall from a verified clean source
Immediate actions
- Inventory environments for the 19 affected PyPI packages and quarantine/remove any matching the malicious versions (e.g., dynamo-release 1.5.4, spateo-release 1.1.2, coolbox 0.4.1-0.4.2, ufish/napari-ufish 0.0.2-0.0.3)
- Hunt for *-setup.pth and _index.js files in site-packages and the sentinel .bun_ran plus b.zip/b/bun under temp directories
- Rotate ALL developer and CI/CD credentials reachable from affected hosts/runners: GitHub PATs and Actions secrets, npm/PyPI/RubyGems/JFrog/CircleCI tokens, Anthropic API keys, AWS/GCP/Azure creds, Kubernetes service-account tokens, Vault tokens, SSH keys, Docker configs
- Audit GitHub orgs/users for unexpected public repos with description 'Hades - The End for the Damned' or commits containing 'IfYouYankThisTokenItWillNukeTheComputerOfTheOwnerFully'
Workarounds
- Set PYTHONNOUSERSITE / use isolated virtualenvs and audit .pth files before interpreter launch
- Restrict outbound access from developer and CI environments to required registries only
Longer-term hardening
- Pin and hash-verify Python dependencies; enable PyPI Trusted Publishing and require 2FA on all maintainer accounts
- Deploy EDR/CI instrumentation (e.g., StepSecurity harden-runner) to detect anomalous egress from build runners
- Block or alert on Python interpreters spawning subprocess downloads of third-party runtimes (Bun/Node) at startup
- Adopt least-privilege, short-lived CI tokens and network egress allowlists on runners
Weaknesses (CWE) in Shai-Hulud "Hades" Miasma Worm
CWE-506, CWE-829, CWE-494, CWE-522, CWE-912
Timeline of Shai-Hulud "Hades" Miasma Worm
- TeamPCP publishes full Shai-Hulud source code to GitHub and promotes copycat campaigns on BreachForums.
- Mini Shai-Hulud worm compromises TanStack, Mistral AI, Guardrails AI and other npm packages.
- Miasma variant compromises 30+ @redhat-cloud-services npm packages via trusted publishing.
- Socket tallies 448 total affected artifacts across the campaign: 411 npm (106 packages) and 37 PyPI (19 packages).
- Socket publishes 'Shai-Hulud Descends to Hades' analysis detailing the *-setup.pth Bun loader and _index.js stealer.
- Incident responder 'boredchilada' flags new PyPI wave on Bluesky; Socket Research Team confirms 37 malicious wheels across 19 PyPI packages.
Sources cited for Shai-Hulud "Hades" Miasma Worm
- Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
- Bun v1.3.13 GitHub Release (abused download endpoint)
- Shai-Hulud - Miasma: The Spreading Blight Hits Red Hat npm Packages
- Miasma/Mini Shai-Hulud Compromise of Red Hat npm Packages (CA-26-018)
- Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
- TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages
- The npm Threat Landscape: Attack Surface and Mitigations
Threats related to Shai-Hulud "Hades" Miasma Worm
- ChainDrop: Massive npm Supply-Chain Infostealer Worm Compromises 1,300+ Packages via Keyv Maintainer Account Hijack
- Shai-Hulud 'Hades' Campaign — Trojanized PyPI Packages Auto-Execute Bun Credential Stealer via Python Wheel Startup Hooks (*-setup.pth)
- Miasma — @redhat-cloud-services npm Supply Chain Compromise (Mini Shai-Hulud Variant, GitHub Actions OIDC/SLSA Abuse with GCP/Azure Cloud-Identity Theft)
- Miasma Worm Compromises 73 Microsoft GitHub Repositories Across Azure, Azure-Samples, Microsoft & MicrosoftDocs — Self-Replicating Mini Shai-Hulud Variant Weaponizing AI Coding Agents (TeamPCP)
- Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
- Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)
Detection coverage for TL-2026-0709
As of 2026-06-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0709 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.