Hades campaign plants Bun-based stealer in 19 PyPI packages

Security researchers at Socket and StepSecurity found 37 malicious wheel artifacts across 19 packages on the Python Package Index. The trojanized releases install files that execute during Python startup, download the Bun JavaScript runtime from GitHub, and run an obfuscated _index.js credential stealer.

The compromised packages include utility libraries such as bramin, cmd2func and coolbox, and a set of computational-biology and bioinformatics projects including embiggen and ensmallen. In some cases the entry point is a *-setup.pth file processed by Python’s site module; in others an obfuscated single-line import hook was embedded in __init__.py to trigger the same chain.

The dropper fetches Bun as a ZIP archive, unpacks the runtime and launches the JavaScript stealer. The stealer collects tokens and secrets from developer and CI systems, including credentials tied to GitHub, npm, PyPI, RubyGems, JFrog, CircleCI, Anthropic, AWS, GCP, Azure and Kubernetes. It also harvests Docker configuration files, Vault tokens, SSH keys, shell histories and common credential files such as .env, .npmrc and .pypirc. Before activating, the code checks the system locale and avoids machines set to Russian locales.

Analysts observed evasion measures aimed at automated scanners. The malware contains plain-text prompt injections intended to mislead LLM-based package analysis tools and polls GitHub commits for specific keywords, including “TheBeautifulSnadsOfTime” and “firedalazer,” to fetch Base64-encoded JavaScript payloads and Python droppers. Socket’s analysis included a summary of the campaign’s approach: “The core playbook remains the same: abuse trusted package channels, execute before normal package use, stage a Bun-powered JavaScript payload, steal developer and CI/CD credentials, and use GitHub-centric exfiltration and propagation logic.”

The attack includes propagation and sabotage features. The code can move laterally over SSH or SCP, push trojanized package releases by exploiting developers’ OpenID Connect trust, and install a background service named “gh-token-monitor” that executes destructive commands if a stolen GitHub token is revoked. Researchers also reported the actor’s ability to read the memory of GitHub Actions runner processes to extract secrets and noted newly observed memory-scraping capabilities for macOS and Windows in addition to existing Linux techniques.

StepSecurity reported an attempted compromise of a popular open-source AI developer tool repository tied to the GitHub account “LeonOstrez,” where an attacker force-pushed a variant of the Shai-Hulud credential-stealing worm. The injected file failed the project’s formatting and linting checks and was rejected by the ruff code formatter, preventing the change from being accepted.

Security firms tracking the activity warned that signed packages and authenticated maintainer accounts are not absolute protections when upstream registries or repositories are breached. The campaign continues a series of Mini Shai-Hulud and Miasma incidents that rely on automated execution during install or startup, Bun-powered payloads and GitHub-based exfiltration and propagation.