Critical PyPI Vulnerability Compromises 23 Packages, Targets MCP Developers

Key Takeaways

• The “Shai-Hulud” supply chain campaign has expanded significantly, compromising 23 new PyPI packages, bringing the total to 60 malicious PyPI artifacts across 37 packages.
• Threat actors are employing three sophisticated delivery mechanisms, including a novel “split-staging” architecture that separates the loader from the payload to evade detection.
• The campaign specifically targets developers in bioinformatics and those working with Model Context Protocol (MCP) integrations, along with typosquatting popular Python libraries.
• The malware, identified as a Hades-family stealer, exfiltrates a wide array of sensitive credentials and tokens from developer workstations and CI/CD environments.
• An anti-analysis technique uses a large, fake system instruction block within JavaScript comments to confuse AI-assisted triage tools, though traditional detection methods remain effective against the core payload.

Shai-Hulud Campaign Expands, Compromising 23 New PyPI Packages with Evolving Tactics

The “Shai-Hulud” supply chain campaign has escalated its operations, incorporating 23 previously undetected malicious package versions on PyPI. This expansion significantly broadens an already concerning threat landscape that had previously impacted 37 packages, according to research by the Socket Threat Research team.

The extensive campaign, which includes distinct threat clusters dubbed Mini Shai-Hulud, Miasma, and Hades, now encompasses a staggering 471 total artifacts across both npm and PyPI. This includes 411 npm artifacts spread across 106 packages and 60 PyPI artifacts across 37 packages, demonstrating a wide-reaching and persistent threat to the software supply chain.

Sophisticated Delivery Mechanisms

A critical aspect of this latest wave is the rapid evolution of the threat actors’ delivery methods. The campaign now leverages at least three distinct and increasingly sophisticated PyPI delivery branches to deploy its malicious payloads:

• .pth startup-hook pattern: This method involves a malicious wheel bundling a *-setup.pth file alongside an _index.js payload. The .pth hook activates during Python startup, surreptitiously downloading the Bun JavaScript runtime and subsequently executing the obfuscated stealer payload.
• Native extension import trigger: Malicious code is directly embedded within compiled .abi3.so extensions. This technique is particularly stealthy, as the Python source code appears benign. However, the extension executes _index.js as soon as Python loads the module via dlopen(), effectively bypassing detection pipelines that rely solely on source code review.
• langchain-core-mcp loader variant: Representing the most innovative technique, this variant installs a .pth loader but deliberately omits the _index.js payload from the wheel. Instead, it meticulously scans every entry in sys.path and one directory below each entry, searching for the payload elsewhere within the Python environment. This “split-staging” architecture is designed to evade detection rules that expect the loader and its payload to reside within the same package.

Targeted Packages and Anti-Analysis Techniques

The 23 newly compromised artifacts are strategically organized into three thematic clusters, aiming to maximize exposure among specific developer communities:

• Bioinformatics packages: This cluster features trojanized versions of legitimate research tools such as embiggen, ensmallen, gpsea, phenopacket-store-toolkit, ppkt2synergy, and pyphetools. These packages are commonly used in critical workflows like graph learning, patient phenotyping, and genomics.
• MCP/AI-themed packages: Directly targeting developers integrating with the Model Context Protocol (MCP), this group includes langchain-core-mcp, openai-mcp, instructor-mcp, tiktoken-mcp, and ray-mcp-server.
• Typosquat packages: Designed to trick developers into mistyping popular library names, this cluster includes rsquests, tlask, and rlask, mimicking widely used tools like requests and Flask.

The _index.js payload incorporates a novel anti-analysis technique specifically targeting Large Language Model (LLM)-assisted security tools. It embeds a substantial, fake system-instruction block within a non-executing JavaScript comment at the top of the file. This comment is ignored by the Bun runtime but is intended to trigger safety refusals, pollute context, and lead to premature or incorrect classification by AI-assisted triage pipelines, as detailed by Socket Threat Research.

Despite this sophisticated evasion tactic, the core malware resides after this comment block, wrapped in a try{eval(...)} call around a character-code array that employs a ROT-style substitution cipher. Traditional detection methods, such as YARA rules, entropy analysis, and Abstract Syntax Tree (AST) parsing, remain effective against this underlying payload.

Upon successful execution via any of the three delivery branches, the Hades-family payload proceeds to aggressively harvest sensitive secrets from compromised developer workstations and CI/CD environments. This includes:

• Authentication tokens for GitHub, npm, PyPI, RubyGems, and JFrog.
• Cloud credentials for AWS, Azure, and GCP, along with Kubernetes service account material.
• SSH keys, Docker configurations, shell histories, and .env files.
• Configuration data for AI developer tools and package registry credentials.

Indicators of Compromise (IOCs)

The following 23 newly identified malicious PyPI artifacts should be immediately blocked or removed from all environments:

What You Should Do

• Immediately audit your project dependencies for any of the listed malicious PyPI packages and versions. Remove them and replace with legitimate, verified alternatives.
• Implement robust supply chain security practices, including requiring package integrity checks (e.g., hash verification) and strictly vetting new dependencies.
• Utilize software composition analysis (SCA) tools to continuously monitor your codebase for known vulnerabilities and malicious packages.
• Enforce multi-factor authentication (MFA) on all developer accounts, package registries (PyPI, npm), and cloud environments (AWS, Azure, GCP).
• Regularly rotate all sensitive credentials, tokens, and SSH keys, especially those used in CI/CD pipelines and developer workstations.
• Educate developers on the risks of typosquatting and the importance of carefully verifying package names before installation.
• Deploy endpoint detection and response (EDR) solutions capable of detecting unusual process execution, unauthorized network connections, and suspicious file modifications on developer machines.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.