Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Miasma worm campaign spreads via PyPI with new Hades-themed JavaScript stealer.
A coordinated PyPI compromise has been detected, involving 37 malicious wheel artifacts across 19 packages. These packages deliver a setup file that automatically executes a JavaScript payload using the Bun runtime, targeting developer and CI/CD secrets. This campaign, identified as a branch of the Shai-Hulud/Miasma lineage, uses Hades-themed exfiltration markers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Bun?
Get an email when a new story names Bun, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers compromised the PyPI repository by uploading 37 malicious wheel artifacts across 19 packages that automatically execute JavaScript payloads to steal developer and CI/CD secrets. The attack exploits the trust developers place in package repositories and leverages automatic execution during package installation to bypass traditional security controls. This supply chain compromise demonstrates how a single malicious package can infiltrate multiple development environments and CI/CD pipelines, potentially leading to broader organizational breaches. The campaign's sophistication, using Bun runtime and themed exfiltration markers, shows attackers are evolving their techniques to target the software development lifecycle directly.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Miasma
- malware — Shai-Hulud
- malware — Hades
- url — https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-linux-x64.zip
- url — https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-darwin-x64.zip
- url — https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-windows-x64.zip
- url — https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-linux-aarch64.zip
- url — https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-darwin-aarch64.zip
- url — https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-windows-aarch64.zip
- url — hxxps://api[.]anthropic[.]com/v1/api
- hash_sha256 — dc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efe
- hash_sha256 — e1342a80d4b5e83d2c7c22e1e0aaa95f2d88e3dbf0d853a4994b180c93a4b17d
- hash_sha256 — c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c
- domain — api.anthropic.com
- url — https://socket.dev/supply-chain-attacks/miasma-mini-shai-hulud-supply-chain-attack