Shai-Hulud Malware Campaign Abuses 23 PyPI Packages in Developer-Focused Attack

A rapidly evolving supply chain campaign dubbed “Shai-Hulud” is targeting developers through malicious Python packages. Researchers have identified 23 newly weaponised PyPI artefacts, expanding the scope of the ongoing Mini Shai-Hulud, Miasma, and Hades malware operations.

The latest findings highlight a shift in attacker tradecraft, combining multiple delivery techniques to compromise developer environments, CI/CD pipelines, and scientific computing workflows.

Shai-Hulud Malware Campaign

Security researchers from Socket report that this new wave builds on previously documented malicious PyPI packages but introduces more advanced execution mechanisms.

Unlike earlier variants that relied heavily on Python startup hooks, the new campaign incorporates native extensions and modular payload delivery, enabling improved evasion and flexibility.

The attackers are actively experimenting with package themes, including bioinformatics libraries and AI/MCP tooling, to increase infection surface among high-value developer targets.

The campaign now spans multiple delivery branches. One technique continues to abuse .pth startup hooks, which allow malicious code to execute automatically when Python initializes.

These hooks download the Bun JavaScript runtime and execute an obfuscated _index.js payload. A second, stealthier approach embeds malicious logic within compiled .abi3.so native extensions, enabling execution at import time.

This method is particularly effective in bioinformatics packages, where compiled extensions are common and often escape scrutiny during code review.

A third notable variant involves the langchain-core-mcp package, which introduces a split-loader technique. Instead of bundling the malicious JavaScript payload, the package deploys a .pth loader that searches Python’s sys.path for an external _index.js file.

This decoupling of loader and payload enables attackers to bypass traditional detection mechanisms that rely on identifying both components within the same package artifact. It also suggests potential staged infections where multiple packages or environments contribute to full payload execution.

The underlying payload follows the Hades malware pattern, leveraging heavily obfuscated JavaScript executed via Bun. Once triggered, it targets sensitive developer assets, including API tokens, cloud credentials, SSH keys, container configurations, and package registry secrets.

Environments such as CI/CD runners are particularly at risk, as compromised credentials can enable further supply chain attacks, including malicious package publishing and infrastructure access.

An additional layer of sophistication is observed in the malware’s anti-analysis techniques. The _index.js payload includes misleading comment blocks designed to disrupt AI-based security analysis tools. These comments attempt to trigger false interpretations or safety filters, delaying detection and complicating automated triage workflows.

The campaign disproportionately targets bioinformatics and AI development ecosystems. Malicious versions of legitimate scientific packages such as embiggen, ensmallen, and pyphetools indicate deliberate targeting of research environments, while typosquatting packages like rsquests and tlask aim to capture unsuspecting developers through naming confusion.

Indicators of Compromise (IOCs) associated with this campaign include the following:

Indicator	Type	Description / Context
dreamgen@1.8.1	Malicious PyPI package	Part of newer Shai-Hulud / Hades PyPI wave, delivers JavaScript stealer payload
embiggen@0.11.97	Malicious PyPI package	Bioinformatics-themed package trojanized in this campaign
ensmallen@0.8.101	Malicious PyPI package	Bioinformatics package using trojanized native extensions
gpsea@0.9.14	Malicious PyPI package	Bioinformatics / genomics-themed package abusing .abi3.so loader
instructor-mcp@1.15.2	Malicious PyPI package	MCP-themed package tied to Mini Shai-Hulud activity
instructor-mcp@1.15.3	Malicious PyPI package	Newer MCP-themed variant in same PyPI wave
langchain-core-mcp@1.4.2	Malicious PyPI package	Uses .pth startup hook, searches sys.path for external index.js payload
langchain-core-mcp@1.4.3	Malicious PyPI package	Same loader family, updated artifact
mem8@6.0.1	Malicious PyPI package	Malicious memory-related package in this campaign
mflux-streamlit@0.0.3	Malicious PyPI package	Streamlit-themed package used as delivery vehicle
mflux-streamlit@0.0.4	Malicious PyPI package	Newer malicious version in same family
openai-mcp@2.41.1	Malicious PyPI package	OpenAI/MCP-themed package targeting AI developers
openai-mcp@2.41.2	Malicious PyPI package	Follow-on malicious version
orchestr8-platform@3.3.2	Malicious PyPI package	Orchestration-themed package abused in this wave
phenopacket-store-toolkit@0.1.7	Malicious PyPI package	Targets scientific / phenotyping workflows
ppkt2synergy@0.1.1	Malicious PyPI package	Bioinformatics-focused package with embedded payload
pyphetools@0.9.120	Malicious PyPI package	Trojanized scientific package using native extension trigger
ray-mcp-server@0.2.1	Malicious PyPI package	MCP server–style package delivering Hades payload
rlask@3.1.7	Typosquatted package	Lookalike of Flask ecosystem packages
rsquests@2.34.3	Typosquatted package	Lookalike of requests library targeting Python developers
tiktoken-mcp@0.13.1	Malicious PyPI package	Tokenization/MCP-themed package linked to campaign
tiktoken-mcp@0.13.2	Malicious PyPI package	Newer malicious version of same package
tlask@3.1.4	Typosquatted package	Flask-themed typosquat designed to capture developer installs
langchain_core-setup.pth	Malicious file	Python startup hook used by langchain-core-mcp loader
langchain_core_mcp-1.4.2-py3-none-any.whl	Malicious wheel	Malicious langchain-core-mcp artifact
langchain_core_mcp-1.4.3-py3-none-any.whl	Malicious wheel	Updated malicious wheel variant
os.path.join(d,”index.js”)	Code pattern	Payload discovery logic scanning sys.path for index.js
s.run([_b,”run”,_j],check=False)	Code pattern	Bun-based execution call for discovered JavaScript payload
Bun/1.3.14	User-Agent	Observed upload UA for langchain-core-mcp PyPI activity
ensmallen_haswell.abi3.so	Malicious native module	Trojanized .abi3.so extension executing payload at import
ensmallen_core2.abi3.so	Malicious native module	Additional trojanized native extension in bioinformatics cluster
.abi3.so paired with index.js	Suspicious layout	Import-time execution pattern requiring review
SHA256: 6d332f814f15f19758d65026bbfd0a8c4…	File hash (SHA256)	Malicious langchain_core_mcp-1.4.2 wheel hash
SHA256: 6506d31707a39949f89534bf9705bcf8…	File hash (SHA256)	Malicious langchain_core-setup.pth file hash
thebeautifulmarchoftime	String / C2 marker	Fallback C2 discovery string used by malware
thebeautifulsnadsoftime	String / C2 marker	Alternate fallback C2 discovery string
/tmp/.sshu-setup.js	File path	SSH propagation script location
/var/run/docker.sock	Host artifact	Legitimate Docker socket targeted for abuse
harden-runner	String / tool reference	Legitimate StepSecurity tool referenced/targeted by malware
step-security	String / tool reference	Legitimate StepSecurity identifier referenced/blocked
stepsecurity	String / tool reference	Alternate StepSecurity identifier referenced/blocked
agent.stepsecurity.io	Domain	Legitimate StepSecurity telemetry domain reportedly blocked
api.stepsecurity.io	Domain	Legitimate StepSecurity API domain reportedly blocked
app.stepsecurity.io	Domain	Legitimate StepSecurity app domain reportedly blocked

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Defenders are advised to audit Python environments for suspicious .pth files, unexpected native extensions, and unauthorized JavaScript execution.

Immediate actions should include removing affected packages, rotating exposed credentials, and reviewing CI/CD pipelines for anomalies. Monitoring sys.path abuse and Bun runtime downloads can also provide early detection signals.

This campaign underscores a broader trend in software supply chain attacks: increasing modularity, cross-language execution, and targeted ecosystem abuse. As threat actors continue refining these techniques, organizations must prioritize dependency security and runtime behavior analysis over static package inspection alone.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.