{"id":1238,"date":"2026-06-09T17:42:08","date_gmt":"2026-06-09T17:42:08","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1238"},"modified":"2026-06-09T17:42:08","modified_gmt":"2026-06-09T17:42:08","slug":"19-packages-poisoned-to-auto-run-bun-credential-stealer","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1238","title":{"rendered":"19 Packages Poisoned to Auto-Run Bun Credential Stealer"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEimsh1r7uS0J7o39IjoPTuHOzh-EiqtvAat_29YiejSgsn0oTvwmlklYrtu0VqUU05z-THGSE__CFshF8lpSdkRbx-b7Ez0uvlBnWcNQntBPcjv08iKy_hqq5W6NrLSUFek3FfLN5Z6ookVi6zqFE_uQhF56Nu_uyorkUuHOlYxm-cpfFsDwMUhWNRB9Mxi\/s1700-e365\/python-worm.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><\/a><\/div>\n<p>The Miasma supply chain campaign has sparked a fresh attack wave called <b>Hades<\/b>, this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index (PyPI) registry, as the Mini Shai-Hulud-style attacks continue to be refined and splintered to target specific ecosystems.<\/p>\n<p>\u00abThe compromised releases shipped a *-setup.pth file that attempts to execute automatically during Python startup, download the Bun JavaScript runtime, and run an obfuscated JavaScript payload named _index.js,\u00bb Socket <a href=\"https:\/\/socket.dev\/blog\/shai-hulud-descends-to-hades-miasma-pypi-wave\">said<\/a> in a new analysis.<\/p>\n<p>The list of identified packages is below &#8211;<\/p>\n<ul>\n<li>bramin 0.0.2, 0.0.3, 0.0.4<\/li>\n<li>cmd2func 0.2.2, 0.2.3<\/li>\n<li>coolbox 0.4.1, 0.4.2<\/li>\n<li>dynamo-release 1.5.4<\/li>\n<li>executor-engine 0.3.4, 0.3.5<\/li>\n<li>executor-http 0.1.3, 0.1.4<\/li>\n<li>funcdesc 0.2.2, 0.2.3<\/li>\n<li>magique 0.6.8, 0.6.9<\/li>\n<li>magique-ai 0.4.4, 0.4.5<\/li>\n<li>mrbios 0.1.1, 0.1.2<\/li>\n<li>napari-ufish 0.0.2, 0.0.3<\/li>\n<li>nucbox 0.1.2, 0.1.3<\/li>\n<li>okite 0.0.7, 0.0.8<\/li>\n<li>pantheon-agents 0.6.1, 0.6.2<\/li>\n<li>pantheon-toolsets 0.5.5, 0.5.6<\/li>\n<li>spateo-release 1.1.2<\/li>\n<li>synago 0.1.1, 0.1.2<\/li>\n<li>ufish 0.1.2, 0.1.3<\/li>\n<li>uprobe 0.1.3, 0.1.4<\/li>\n<\/ul>\n<p>Like in the previous Shai-Hulud and Miasma campaigns, the malicious payload downloads and installs the Bun JavaScript runtime, which is then used to launch a heavily obfuscated JavaScript stealer that can harvest a wide range of data from developer systems.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-cant-stop-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjPEV6-530TOlxG6PjrmdlY623wpBwduZ7t1HV6flcmO5R4q4AmfixDUzW0CrhlvMVNWbhvOIso-UDNTka4W_W9Chrdj_dglwBZwi7DuePM2IMIl-hfUYVIqBXgfpr_2619K8Gptb4LzwJ6gUbi7lWl2M8AFQJsHEaw63Q7tZ6708YGruiHrr0Y2W9YYxLQ\/s728-e100\/ThreatLocker-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>This includes secrets associated with GitHub, npm, PyPI, RubyGems, JFrog, CircleCI, Anthropic, AWS, GCP, Azure, and Kubernetes, along with Docker configurations, Vault tokens, SSH keys, shell histories, .env files, .npmrc files, .pypirc files, Claude\/MCP configurations, and other local or runner-accessible credentials.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>What&#8217;s changed this time around is the campaign marker. While previous iterations exported the harvested data to a public GitHub repository with the description \u00abMiasma: The Spreading Blight,\u00bb \u00abMiasma: The Spreading Blight,\u00bb and \u00abMiasma &#8211; The Spreading Blight,\u00bb the latest wave <a href=\"https:\/\/github.com\/search?q=%22Hades+The+End+for+the+Damned%22&amp;type=repositories\">includes<\/a> the repository descriptions &#8211;<\/p>\n<ul>\n<li>Hades &#8211; The End for the Damned<\/li>\n<li>Hades * The End for the Damned<\/li>\n<\/ul>\n<p>\u00abThat makes Hades best understood as a PyPI branch of the same Mini Shai-Hulud \/ Miasma lineage, not a standalone Python malware incident,\u00bb the application security company said. \u00abThe core playbook remains the same: abuse trusted package channels, execute before normal package use, stage a Bun-powered JavaScript payload, steal developer and CI\/CD credentials, and use GitHub-centric exfiltration and propagation logic.\u00bb<\/p>\n<p>What has changed this time around is the use of a *-setup.pth file that&#8217;s processed by Python&#8217;s \u00absite\u00bb module during interpreter startup, resulting in the execution of the malicious payload after installation without requiring the victim to import the poisoned package. The payload, in turn, downloads and runs Bun from GitHub and runs the stealer, but not before checking if the system corresponds to the Russian locale.<\/p>\n<p>\u00abThis is the Python equivalent of the npm install-hook problem that Shai-Hulud and Miasma repeatedly exploit,\u00bb Socket explained. \u00abThe syntax is different, but the security consequence is the same: dependency installation creates an execution edge before application code is reviewed or invoked.\u00bb<\/p>\n<h3>Hades Cluster Attempts to Mislead AI Security Scanners<\/h3>\n<p>Also compromised as part of the Hades campaign are a number of packages related to the computational biology, bioinformatics, and genotype-phenotype analysis ecosystem &#8211;<\/p>\n<ul>\n<li>embiggen 0.11.97<\/li>\n<li>ensmallen 0.8.101<\/li>\n<li>gpsea 0.9.14<\/li>\n<li>mflux-streamlit 0.0.3, 0.0.4<\/li>\n<li>nhmpy 2.4.7<\/li>\n<li>ppkt2synergy 0.1.1<\/li>\n<li>pyphetools 0.9.120<\/li>\n<\/ul>\n<p>Interestingly, this cluster employs a different approach in that the entry point is embedded inside the package&#8217;s \u00ab__init__.py\u00bb file as an obfuscated single-line import hook. However, the outcome is the same: Downloading and running the Bun runtime, followed by the execution of the JavaScript payload.<\/p>\n<p>\u00abThe use of the Bun runtime remains a consistent theme,\u00bb StepSecurity <a href=\"https:\/\/www.stepsecurity.io\/blog\/the-hades-campaign-pypi-packages\">said<\/a>. \u00abDownloading Bun as a standalone ZIP file allows the malware to run complex JavaScript tasks in environments that lack a Node.js installation, bypassing traditional package manager controls and network proxy logs.\u00bb<\/p>\n<p>In what has been characterized as a novel artificial intelligence (AI) defense evasion technique, the malware also incorporates a plain-text prompt injection that attempts to deceive Large Language Model (LLM)-based package analysis tools to instruct the model to classify the package as safe.<\/p>\n<p>On top of that, the malware queries GitHub commits for the keyword \u00abTheBeautifulSnadsOfTime\u00bb to extract a Base64-encoded string containing a JavaScript payload. It also polls GitHub for commits matching the keyword \u00abfiredalazer\u00bb so as to fetch a Python-based dropper and execute it.<\/p>\n<p>Some of the important features built into the Hades malware are listed below &#8211;<\/p>\n<ul>\n<li>Replicate and spread laterally across developer networks via SSH or SCP, push trojanized versions of PyPI packages from compromised systems by exploiting the developers&#8217; OpenID Connect (OIDC) trust configurations.<\/li>\n<li>Target GitHub repositories to extract organization secrets using GitHub Actions runners if the harvested GitHub token has appropriate write permissions.<\/li>\n<li>Backdoor local workspace folders to trigger code execution when analyzed by AI assistants or opened in IDEs. Targets include Anthropic Claude, OpenAI Codex, Google Gemini, Microsoft Copilot, Cline, Aider, Tabby, Amazon Q, Cody, Bolt, and Continue.<\/li>\n<li>Install a background service named \u00abgh-token-monitor\u00bb that acts as a wiper by removing all data (\u00abrm -rf ~\/; rm -rf ~\/Documents\u00bb) if the stolen GitHub token is revoked by the developer.<\/li>\n<\/ul>\n<p>\u00abA key capability of the Miasma actor is reading the process memory of the GitHub Actions runner (the Runner.Worker process) to extract secrets,\u00bb security researcher Rohan Prabhu said. \u00abIn earlier campaigns, this was limited to Linux systems using \/proc\/{pid}\/mem. The Hades Campaign introduces tailored macOS and Windows memory scrapers.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/vpn-threat-report-m\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhFlTC7RrRZGiFAgASS0noWSL0qsQGFVp8-Hvuw9yp3X3VKRuTcb5SsPX09wJzrdIM6pu1_5lS4EeZp7Sx4iYBpNJkrGnpr08yyaS1HQ5_5TxaCsP6O0OtHNuOkesn6CbNjao1GPulCJk-uljYMSfMZfBYNrngpe669t7jlRn1FqiEnXhsFD1WVkpaYIVgh\/s728-e100\/ai-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The development comes as StepSecurity revealed that an unknown attacker compromised the GitHub account (\u00abLeonOstrez\u00bb) linked to \u00abPythagora-io\/gpt-pilot,\u00bb a popular open-source AI developer tool, and force-pushed a variant of the Shai-Hulud credential-stealing worm to the main branch. The malware is designed to activate silently when an unsuspecting developer runs the project, while avoiding systems with a Russian locale.<\/p>\n<p>\u00abThe malware, a variant of the Shai-Hulud worm, was stopped by an unlikely defender: ruff, a Python code formatter,\u00bb Ashish Kurmi, co-founder and CTO of StepSecurity, <a href=\"https:\/\/www.stepsecurity.io\/blog\/pythagora-io-gpt-pilot-compromised-on-github-shai-hulud-credential-stealer-blocked-by-python-linter\">said<\/a>. \u00abThe attacker tried twice to get the malicious code past CI and failed both times because their injected Python file did not match the project&#8217;s formatting and linting rules.\u00bb<\/p>\n<p>Software supply chain security company Snyk has <a href=\"https:\/\/snyk.io\/blog\/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp\/\">described<\/a> these attacks as part of the Shai-Hulud \/ Miasma lineage, with each wave <a href=\"https:\/\/semgrep.dev\/blog\/2026\/miasma-v2-self-spreading-npm-worm-now-uses-malicious-bindinggyp-file-and-compromises-57-packages\/\">leveraging<\/a> a Bun-runtime obfuscated stealer and combining it with \u00abnew persistence, new exfiltration routes, and new ways to fire code automatically at install or build time.\u00bb<\/p>\n<p>\u00abThe Miasma campaign proves that having signed keys and authenticated maintainer accounts are no longer an absolute guarantee of safety,\u00bb Cloudsmith <a href=\"https:\/\/cloudsmith.com\/blog\/miasma-worms-path-of-destruction\">said<\/a>. \u00abWhen upstream registries and repos are compromised, public code becomes one of the easiest, and most direct, ways of getting pwned.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The Miasma supply chain campaign has sparked a fresh attack wave called Hades, this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index (PyPI) registry,&hellip;<\/p>\n","protected":false},"author":1,"featured_media":1239,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[834,1981,459,35,1488,478],"class_list":["post-1238","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-autorun","tag-bun","tag-credential","tag-packages","tag-poisoned","tag-stealer"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1238"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1238\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1239"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}