# Shai-Hulud 'Hades' Campaign — Trojanized PyPI Packages Auto-Execute Bun Credential Stealer via Python Wheel Startup Hooks (*-setup.pth)

> The Shai-Hulud 'Hades' campaign (a PyPI branch of the self-spreading Mini Shai-Hulud / Miasma lineage attributed to TeamPCP) trojanized at least 19 science- and AI-focused PyPI packages (37+ malicious wheels) by shipping a *-setup.pth file that executes at Python interpreter startup — with no package import required — to download the Bun JavaScript runtime and run an obfuscated _index.js credential stealer. The malware harvests GitHub/npm/PyPI/cloud secrets, self-propagates via SSH/SCP and OIDC trust abuse, and exfiltrates to attacker-created GitHub repositories tagged 'Hades - The End for the Damned'.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0734
- **ID:** TL-2026-0734
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In June 2026 researchers (Socket, SocRadar, StepSecurity, Endor Labs, JFrog) tracked a new PyPI wave of the self-replicating Shai-Hulud supply-chain worm, branded 'Hades – The End for the Damned' and forming a PyPI branch of the Mini Shai-Hulud / Miasma lineage attributed to the threat actor TeamPCP. The campaign trojanized at least 19 PyPI packages across 37+ malicious wheel artifacts, concentrated on bioinformatics/computational-biology tools (dynamo-release, spateo-release, coolbox, ufish, napari-ufish, ensmallen, embiggen, gpsea, pyphetools, mrbios) and AI/MCP developer tooling (pantheon-agents, magique-ai, langchain-core-mcp, openai-mcp, instructor-mcp, tiktoken-mcp, ray-mcp-server), plus requests/Flask typosquats (rsquests, tlask, rlask).

The defining innovation of the Hades wave is the abuse of Python's site-module .pth processing. Each compromised wheel ships a '*-setup.pth' file; because Python's site module executes any .pth line beginning with 'import' at interpreter startup, the malicious code runs the next time Python starts in the environment — during pip, pytest, a notebook kernel, or any CI job — with NO 'import compromised_package' ever required. This converts a passive, unused dependency into a delayed execution trigger and dramatically increases blast radius on CI runners and developer workstations that routinely create virtualenvs. The loader uses urllib.request and subprocess.run to download a pinned Bun runtime (bun-v1.3.13 / v1.3.14) from the legitimate github.com/oven-sh/bun/releases/download path, writes a '.bun_ran' sentinel, and executes a 4.7–4.8 MB obfuscated JavaScript payload named _index.js. A later mutation split loader and payload — searching across sys.path for the payload and embedding obfuscated code in package __init__.py and native .abi3.so extensions — to evade signature-based detection.

The _index.js stealer is cross-platform and multi-stage. It opens with an adversarial prompt-injection block designed to hijack LLM-based security analyzers ('AI analyst misdirection'). It then runs platform-specific in-memory credential scrapers: reading /proc/{pid}/mem on Linux, using Mach task-port APIs via ctypes on macOS, and dynamically compiling C# (VirtualQueryEx / ReadProcessMemory) via PowerShell on Windows — frequently targeting the GitHub Actions 'Runner.Worker' process to lift GitHub Actions secrets. It harvests credentials for GitHub, npm, PyPI, RubyGems, JFrog, CircleCI, Anthropic, AWS, GCP, Azure, and Kubernetes, plus Docker configs, HashiCorp Vault tokens, SSH keys, shell histories, .env / .npmrc / .pypirc files, and Claude/MCP configuration files. The 16-blob payload is protected with AES-256-GCM (per-blob keys) and hybrid AES-256-GCM + RSA-2048 / RSA-PSS-signed dead-drops.

Command-and-control and exfiltration are GitHub-native: the malware polls GitHub commits for keyword dead-drops ('TheBeautifulSnadsOfTime' for eval payloads, 'firedalazer' for the Python dropper, 'DontRevokeOrItGoesBoom' for encrypted tokens) and exfiltrates collected secrets by auto-creating GitHub repositories whose descriptions read 'Hades - The End for the Damned' (underworld-themed name components stygian, tartarean, cerberus, charon, styx, lethe, thanatos, persephone) and uploading 'format-results'/'results/results-<ts>-<counter>.json' artifacts via a 'Run Copilot' workflow. Outbound data is also disguised as traffic to an invalid Anthropic endpoint, https://api.anthropic.com/v1/api. The worm self-propagates by parsing ~/.ssh/known_hosts and ~/.ssh/config to spread over SSH/SCP, and by abusing developers' OIDC trust to mint Fulcio signing certs, generate SLSA provenance, log to Rekor, and publish trojanized package versions with valid signatures. It establishes persistence via Linux systemd units (update-monitor.service, gh-token-monitor.service) and ~/.local/share/updater/update.py, and macOS LaunchAgents, and hijacks IDE/AI assistant config (.cursorrules, .windsurfrules, .github/copilot-instructions.md). A 'wiper deterrent' (gh-token-monitor) watches token validity over a 72-hour TTL and runs destructive 'rm -rf' commands if a stolen token is revoked, discouraging remediation. The campaign tracker has grown to 471 total artifacts (411 npm artifacts across 106 packages; 60 PyPI artifacts across 37 packages).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1528 Steal Application Access Token
- T1057 Process Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1005 Data from Local System
- T1056 Input Capture
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction

## Sources

- [Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave](https://socket.dev/blog/shai-hulud-descends-to-hades-miasma-pypi-wave)
- [Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer](https://thehackernews.com/2026/06/hades-pypi-attack-19-packages-poisoned.html)
- [The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent](https://www.stepsecurity.io/blog/the-hades-campaign-pypi-packages)
- [New Shai-Hulud attack trojanizes 19 science-focused PyPI packages](https://www.bleepingcomputer.com/news/security/new-shai-hulud-attack-trojanizes-19-science-focused-pypi-packages/)
- [Shai-Hulud Hades PyPI Campaign: 19 Packages Trojanized via Wheel Startup Hooks](https://socradar.io/blog/shai-hulud-hades-pypi-campaign/)
- ['Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud](https://www.darkreading.com/application-security/hades-campaign-pypi-shai-hulud)
- [Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks](https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/)
- [Shai-Hulud Hades Wave Hits Six PyPI Bioinformatics Packages via Stolen Tokens](https://www.endorlabs.com/learn/shai-hulud-hades-wave-hits-six-pypi-bioinformatics-packages)
- [Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious Packages](https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious)
- [Shai-Hulud - Miasma: The Spreading Blight Hits Red Hat npm Packages](https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/)
- [New Shai-Hulud Attack Compromises 23 PyPI Packages to Target MCP Developers](https://cybersecuritynews.com/23-pypi-packages-compromised/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0734