Mini Shai-Hulud Hades Vulnerability Affects Multiple Python Package Versions on PyPI
A newly identified strain of the Mini Shai-Hulud supply chain malware, labeled “Hades,” has been detected in 23 PyPI package versions targeting bioinformatics and artificial intelligence-themed projects, according to reports.
Discovery and Initial Findings
The discovery was initially disclosed by Socket on Sunday, following the identification of 37 malicious PyPI artifacts across 19 packages focused on bioinformatics software. The variant derives its name from Hades and Greek mythology-themed elements within the GitHub repositories used for data exfiltration.
Operational Framework
Hades follows the operational framework of TeamPCP’s Mini Shai-Hulud malware but differs in its focus. While the original Mini Shai-Hulud targeted npm and PyPI packages, and a separate variant named Miasma concentrated on npm, Hades is specifically tailored for the PyPI ecosystem.
Delivery Methods
The initial batch of 37 malicious wheel artifacts utilized a.pth startup hook (*-setup.pth) for deployment. Additional analysis revealed that some packages in the latest wave employ a similar delivery method, while others embed malicious execution paths within compiled .abi.so extensions.
First Delivery Approach
In these instances, the JavaScript payload activates during Python package imports, making detection more challenging as the malicious code remains hidden within .py files.
Second Delivery Approach
A third delivery approach was observed in the malicious package langchain-core-mcp, which uses the .pth startup hook to search sys.path for the JavaScript payload without including it in the package itself. This suggests a potential split delivery strategy where the payload is installed separately.
Payload Analysis
The _index.js stealer payload in the latest attacks includes a prompt designed to target large language model (LLM) analysis tools. The code instructs the LLM to assist with the development of biological and nuclear weapons, aiming to provoke a refusal response from the AI system.
Researchers noted that while traditional detection methods such as YARA rules, entropy checks, and behavioral analysis remain effective, the technique presents a practical evasion tactic against naive LLM-first triage systems.
Compromised Packages
The Hades campaign has compromised legitimate bioinformatics tools such as embiggen, ensmallen, gpsea, phenopacket-store-toolkit, ppkt2synergy, and pyphetools. Attackers also created typosquatted packages, including langchain-core-mcp, rsquests, tlask, rlask, and others with AI-related themes.
- embiggen
- ensmallen
- gpsea
- phenopacket-store-toolkit
- ppkt2synergy
- pyphetools
- langchain-core-mcp
- rsquests
- tlask
- rlask
Implications and Security Measures
The incident highlights ongoing efforts by threat actors to exploit package repositories for supply chain attacks, emphasizing the need for enhanced security measures in software distribution channels.
About Author
English