Shai-Hulud Malware Variant Targets Python Developers via PyPI

🔑 Enhanced Key Takeaways

•The malware targets a broad range of developer secrets, including GitHub tokens, npm, PyPI, RubyGems, JFrog publishing tokens, AWS, GCP, Azure, Kubernetes, Vault credentials, SSH keys, Docker configurations, .env files, .npmrc files, .pypirc files, Claude/MCP configurations, and shell histories.
•The "Hades" variant, a new branch of the Mini Shai-Hulud/Miasma campaign, specifically targeted 37 malicious wheel artifacts across 19 packages in the PyPI registry, many of which are popular bioinformatics and deep-learning toolkits.
•The malware employs evasion techniques, such as checking for Russian locales/environments and security tools like StepSecurity Harden-Runner, and can even use adversarial prompt injection to mislead AI security scanners.
•The Shai-Hulud campaign is attributed to the TeamPCP threat group, known for its deep technical expertise in CI/CD exploitation, credential harvesting, and malware obfuscation, and has been observed using valid SLSA Build Level 3 provenance to sign malicious packages.
•A destructive "dead-man switch" or "wiper process" is a core component of the Hades design, which attempts to erase the user's local files if a security team detects and revokes stolen GitHub tokens, creating a high-stakes situation for incident responders.

🛠️ Technical Deep Dive

.pth file exploitation: The *-setup.pth file is designed to execute automatically during Python startup, downloading the Bun JavaScript runtime and running an obfuscated JavaScript payload named _index.js. This exploits Python's native execution of lines starting with an import statement during initialization, turning a passive dependency into an active weapon.
Bun JavaScript runtime usage: Bun is downloaded as a standalone ZIP file from GitHub Releases, allowing the malware to run complex JavaScript tasks in environments lacking a Node.js installation, bypassing traditional package manager controls and network proxy logs. It's chosen for its speed, all-in-one nature, and relative newness in malware campaigns, making it less easily detected.
Payload execution: The Bun runtime executes an obfuscated JavaScript payload (e.g., _index.js, execution.js, router_runtime.js) which performs anti-virtual machine checks, communicates with C2 infrastructure, decrypts follow-on payloads (often NWHStealer), and injects them into memory using Windows APIs like VirtualAlloc and LoadLibraryA.
Credential harvesting: The malware scrapes process memory (e.g., /proc/{pid}/mem on Linux, tailored scrapers for macOS/Windows) of GitHub Actions runner processes to extract secrets, including those masked by CI systems. It targets over 100 file paths for credentials and uses tools like TruffleHog for secret discovery.
Propagation and persistence: The worm actively searches for publishing access (e.g., npm, PyPI tokens), modifies package tarballs, injects malicious metadata, and republishes infected artifacts. It also establishes persistence via scheduled tasks, GitHub Actions workflows (e.g., discussion.yaml to register self-hosted runners), and monitors stolen tokens.
Exfiltration: Stolen data is compressed, encrypted (e.g., AES-256-GCM), and exfiltrated to attacker-controlled C2 servers or new public GitHub repositories created under the victim's account, often with descriptions like "Hades — The End for the Damned" or "Shai-hulud Migration".

🔮 Future ImplicationsAI analysis grounded in cited sources

PyPI and other package registries will face an increasing volume and sophistication of supply chain attacks.

The Shai-Hulud campaign demonstrates advanced techniques like .pth file exploitation, multi-ecosystem targeting (npm, PyPI), and evasion, which are likely to be adopted by other threat actors.

Security measures for open-source package ecosystems will need to evolve rapidly to counter advanced evasion and propagation tactics.

The malware's use of valid SLSA provenance, AI analyst misdirection, and destructive wipers necessitates more robust detection, verification, and incident response mechanisms beyond current capabilities.

The use of legitimate, modern runtimes like Bun in malware will become more prevalent.

Bun's performance, self-contained nature, and relative novelty in malware campaigns offer attackers advantages in stealth and bypassing traditional Node.js-focused defenses.

⏳ Timeline

2022-08

Early PyPI typosquatting attacks discovered, stealing credentials via malicious packages masquerading as legitimate ones (e.g., 'requests').

2025-01

Initial discovery of the Shai-Hulud worm, primarily targeting the npm ecosystem with self-replication and credential theft capabilities.

2025-07

Rapid7 reports on the abuse of Python's pickle files (.pth files) in AI model supply chains on platforms like Hugging Face to deploy remote access trojans.

2025-11

The Shai-Hulud 2.0 campaign adopts the Bun JavaScript runtime for malicious execution, targeting the pre-install phase of software dependencies for stealthier execution.

2026-03

The TeamPCP threat group, linked to Shai-Hulud, compromises legitimate PyPI packages (LiteLLM, Telnyx) as part of a broader supply chain attack.

2026-06

The 'Hades' variant of the Shai-Hulud/Miasma campaign specifically targets 19 PyPI packages, particularly in bioinformatics and deep learning, using .pth files, Bun, and advanced evasion tactics including a wiper deterrent.

Shai-Hulud Malware Variant Targets Python Developers via PyPI

⚡ 30-Second TL;DR

Key Points

🧠 Deep Insight

🔑 Enhanced Key Takeaways

🛠️ Technical Deep Dive

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline

📎 Sources (24)

👉Related Updates

New Malware Targets AI Infrastructure and Coding Systems

Glow emerges from stealth at $1.2B valuation for AI security

OpenAI AI Escapes Sandbox and Breaches Hugging Face