Shai-Hulud Malware Campaign Abuses 23 PyPI Packages in Developer-Focused Attack

A rapidly evolving supply chain campaign dubbed “Shai-Hulud” is targeting developers through malicious Python packages. Researchers have identified 23 newly weaponised PyPI artefacts, expanding the scope of the ongoing Mini Shai-Hulud, Miasma, and Hades malware operations.

The latest findings highlight a shift in attacker tradecraft, combining multiple delivery techniques to compromise developer environments, CI/CD pipelines, and scientific computing workflows.

Shai-Hulud Malware Campaign

Security researchers from Socket report that this new wave builds on previously documented malicious PyPI packages but introduces more advanced execution mechanisms.

Unlike earlier variants that relied heavily on Python startup hooks, the new campaign incorporates native extensions and modular payload delivery, enabling improved evasion and flexibility.

The attackers are actively experimenting with package themes, including bioinformatics libraries and AI/MCP tooling, to increase infection surface among high-value developer targets.

The campaign now spans multiple delivery branches. One technique continues to abuse .pth startup hooks, which allow malicious code to execute automatically when Python initializes.

These hooks download the Bun JavaScript runtime and execute an obfuscated _index.js payload. A second, stealthier approach embeds malicious logic within compiled .abi3.so native extensions, enabling execution at import time.

This method is particularly effective in bioinformatics packages, where compiled extensions are common and often escape scrutiny during code review.

A third notable variant involves the langchain-core-mcp package, which introduces a split-loader technique. Instead of bundling the malicious JavaScript payload, the package deploys a .pth loader that searches Python’s sys.path for an external _index.js file.

This decoupling of loader and payload enables attackers to bypass traditional detection mechanisms that rely on identifying both components within the same package artifact. It also suggests potential staged infections where multiple packages or environments contribute to full payload execution.

The underlying payload follows the Hades malware pattern, leveraging heavily obfuscated JavaScript executed via Bun. Once triggered, it targets sensitive developer assets, including API tokens, cloud credentials, SSH keys, container configurations, and package registry secrets.

Environments such as CI/CD runners are particularly at risk, as compromised credentials can enable further supply chain attacks, including malicious package publishing and infrastructure access.

An additional layer of sophistication is observed in the malware’s anti-analysis techniques. The _index.js payload includes misleading comment blocks designed to disrupt AI-based security analysis tools. These comments attempt to trigger false interpretations or safety filters, delaying detection and complicating automated triage workflows.

The campaign disproportionately targets bioinformatics and AI development ecosystems. Malicious versions of legitimate scientific packages such as embiggen, ensmallen, and pyphetools indicate deliberate targeting of research environments, while typosquatting packages like rsquests and tlask aim to capture unsuspecting developers through naming confusion.

Indicators of Compromise (IOCs) associated with this campaign include the following:

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Defenders are advised to audit Python environments for suspicious .pth files, unexpected native extensions, and unauthorized JavaScript execution.

Immediate actions should include removing affected packages, rotating exposed credentials, and reviewing CI/CD pipelines for anomalies. Monitoring sys.path abuse and Bun runtime downloads can also provide early detection signals.

This campaign underscores a broader trend in software supply chain attacks: increasing modularity, cross-language execution, and targeted ecosystem abuse. As threat actors continue refining these techniques, organizations must prioritize dependency security and runtime behavior analysis over static package inspection alone.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.