'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud

The latest campaign, spearheaded by a variant of the Shai-Hulud worm, has seen attackers exploiting vulnerabilities within the PyPI ecosystem. Specifically, 37 malicious PyPI wheels and 19 code packages were compromised, utilizing a technique that leverages Python's .pth startup files to execute a JavaScript credential stealer. This tactic relies on Bun, a JavaScript runtime, to obfuscate the payload and execute it, bypassing typical Node.js or Python runtime environments. The campaign's evolution is marked by the introduction of 'Hades'-themed GitHub exfiltration markers and the use of repository component names referencing mythological underworld figures, demonstrating an ongoing adaptation by the threat actors.

The core of the attack relies on the exploitation of Python's .pth startup feature, which, when abused, transforms passive dependencies into delayed execution triggers. This mirrors a previous vulnerability exploited by Shai-Hulud and Miasma, where dependency installation creates an execution edge before application code is reviewed. The attackers are actively targeting developer, cloud, package-publishing, and CI/CD secrets, showcasing a sophisticated approach to data theft. The campaign's adaptability is further evidenced by its use of this less common execution mechanism, suggesting a continued evolution of the malware.

While the specific actors behind the Shai-Hulud attacks remain unconfirmed, the campaign highlights the persistent threat posed by supply chain attacks and the need for robust auditing practices within open-source development. Previous Mini Shai-Hulud attacks have been attributed to TeamPCP, demonstrating the ongoing evolution of this malware family.