# Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth Startup Hook to Launch Bun-Powered Credential Stealer

> Socket identified a new PyPI wave of the self-propagating Shai-Hulud/Miasma supply-chain worm on June 7, 2026: 37 malicious wheel artifacts across 19 packages ship a *-setup.pth startup hook that auto-executes on Python launch, downloads the Bun runtime from GitHub, and runs an obfuscated _index.js stealer that harvests developer and CI/CD credentials (GitHub, npm, PyPI, AWS, GCP, Azure, Kubernetes, Vault, SSH keys, Docker, Anthropic) and exfiltrates them to attacker-created public GitHub repositories. This PyPI branch self-tags 'Hades - The End for the Damned' and is part of a broader 448-artifact cross-ecosystem campaign.

- **Published:** 2026-06-07T00:00:00Z
- **Last reviewed:** 2026-06-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0709
- **ID:** TL-2026-0709
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Shai-Hulud
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On June 7, 2026, the Socket Research Team disclosed a new PyPI wave of the Shai-Hulud/Miasma self-propagating supply-chain worm, branded 'Hades' for its Python iteration. The wave comprises 37 malicious wheel artifacts across 19 PyPI projects — heavily skewed toward bioinformatics and genomics tooling (dynamo-release, spateo-release, coolbox, ufish, napari-ufish, mrbios) alongside developer-automation libraries (executor-engine, executor-http, funcdesc, cmd2func, pantheon-agents, pantheon-toolsets, magique, magique-ai). The campaign was initially flagged by incident responder 'boredchilada' on Bluesky and attributed to the Mini Shai-Hulud/Miasma lineage previously responsible for the Red Hat Cloud Services npm compromise (June 1, 2026) and the TeamPCP source-code release (May 12, 2026).

Execution chain: Each malicious wheel contains a *-setup.pth file holding a single executable Python line. Python's site module processes .pth files during interpreter startup and executes any line beginning with 'import' followed by whitespace, so the loader runs automatically the next time the interpreter launches in the affected environment — no explicit import of the package is required. The .pth loader (SHA256 c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c, identical across all 37 artifacts) creates a sentinel file .bun_ran in the temp directory, locates the bundled _index.js payload, and — if Bun is not already cached — downloads Bun v1.3.13 from the legitimate GitHub releases endpoint (github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-{os}-{arch}.zip) using urllib.request.urlretrieve(). It extracts the runtime to tempdir/b/bun and executes the payload via subprocess.run([bun, 'run', payload]). Using Bun — a non-standard runtime for a Python payload — is itself a fingerprint tying this wave to the npm-origin Shai-Hulud family.

Stealer: The _index.js payload exists in two obfuscated variants (SHA256 dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efe, ~4.8 MB, across 17 packages; and e1342a80d4b5e83d2c7c22e1e0aaa95f2d88e3dbf0d853a4994b180c93a4b17d, ~4.7 MB, across 2 packages). Obfuscation layers include character-code decoding, ROT-style alphabet substitution, AES-128-GCM and AES-256-GCM encryption, PBKDF2/SHA256 string decoding, and gzip compression. The stealer enumerates and harvests: GitHub credentials, Actions secrets, runner memory and ghs_* tokens; npm, PyPI, RubyGems, JFrog, CircleCI tokens; Anthropic API tokens; AWS credentials, STS identity, SSM Parameter Store and Secrets Manager; GCP identity/projects and Secret Manager; Azure identity and Key Vault; Kubernetes service-account tokens; SSH keys, Docker configs, Git credentials; .env, .npmrc, .pypirc files; shell histories; Claude/MCP configs; Vault tokens and wallet/application data.

Exfiltration: The primary channel creates public repositories via the GitHub API (POST /user/repos) to store encrypted/compressed credential dumps under results/results-<timestamp>-<counter>.json. Exfil repos carry the marker description 'Hades - The End for the Damned', use commit messages containing 'IfYouYankThisTokenItWillNukeTheComputerOfTheOwnerFully', and draw randomized names from a mythological word pool (stygian, tartarean, cerberus, charon, styx, lethe, thanatos, persephone). A secondary channel uses GitHub Actions artifact exfiltration via a workflow named 'Run Copilot' uploading an artifact 'format-results' (file format-results.txt). A tertiary set of HTTPS requests to api.anthropic.com/v1/api:443 is assessed as network-log camouflage rather than functional exfil (the path returns 404).

Self-propagation and persistence: As a worm in the Shai-Hulud lineage, stolen package-registry tokens (npm, PyPI) enable downstream re-publishing to additional packages. Recovered persistence and follow-on artifacts target developer-automation and AI-assisted coding environments: ~/.config/gh-token-monitor/, ~/.local/bin/gh-token-monitor.sh, ~/.config/systemd/user/gh-token-monitor.service, ~/Library/LaunchAgents/com.github.token-monitor.plist, ~/.local/share/updater/update.py, .claude/setup.mjs, .github/setup.js, and .github/workflows/codeql.yml. Evasion logic checks for Russian locale/environment signals, StepSecurity/harden-runner instrumentation, and validates decoy-token prefixes (GitHub, npm, Anthropic, CircleCI, AWS) before acting. Socket tracks 448 total affected artifacts across the campaign: 411 npm artifacts (106 packages) and 37 PyPI artifacts (19 packages).

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.006 Command and Scripting Interpreter: Python
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1037 Boot or Logon Initialization Scripts
- T1543.002 Create or Modify System Process: Systemd Service
- T1543.001 Create or Modify System Process: Launch Agent
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1555 Credentials from Password Stores
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1580 Cloud Infrastructure Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1102.002 Web Service: Bidirectional Communication
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1531 Account Access Removal

## Sources

- [Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave](https://socket.dev/blog/shai-hulud-descends-to-hades-miasma-pypi-wave)
- [Bun v1.3.13 GitHub Release (abused download endpoint)](https://github.com/oven-sh/bun/releases/tag/bun-v1.3.13)
- [Shai-Hulud - Miasma: The Spreading Blight Hits Red Hat npm Packages](https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/)
- [Miasma/Mini Shai-Hulud Compromise of Red Hat npm Packages (CA-26-018)](https://www.deepwatch.com/labs/ca-26-018-miasma-mini-shai-hulud-compromise-of-red-hat-npm-packages/)
- [Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages](https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html)
- [TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages](https://hackread.com/teampcp-mini-shai-hulud-worm-npm-pypi-packages/)
- [The npm Threat Landscape: Attack Surface and Mitigations](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0709