New Shai-Hulud attack trojanizes 19 science-focused PyPI packages

# Shai-Hulud Supply Chain Attack Trojanzies 19 PyPI Packages, Targeting Developer Secrets at Scale

A sophisticated supply chain attack has compromised 19 legitimate Python packages on the PyPI repository, collectively downloaded hundreds of thousands of times, in what researchers are calling an expansion of the "Shai-Hulud" malware campaign. The attack injected malware designed to steal developer credentials, API tokens, and CI/CD secrets—marking yet another critical vulnerability in the open-source software ecosystem that underpins modern software development.

Application security firm Socket discovered the compromise and linked it to the broader Shai-Hulud campaign, which has now grown to include 453 malicious artifacts across multiple supply chains. The affected packages include widely-used bioinformatics tools like Dynamo, Spateo, CoolBox, U-FISH, and Napari-UFISH—research-focused software that developers in academic and pharmaceutical environments rely on.

## The Attack Mechanics

The malicious packages employed a sophisticated two-stage delivery mechanism that exploits Python's execution model. Each compromised wheel contained two key malicious artifacts:

1. A .pth (path) file with an innocuous-sounding filename — Python automatically executes code in .pth files during initialization, making them an ideal persistence mechanism

2. An obfuscated JavaScript payload named _index.js — the actual malware that performs credential harvesting

The attack chain works as follows:

Stage 1: Passive Installation

When a developer installs a compromised package via pip, the malicious .pth file is placed in Python's site-packages directory. No immediate execution occurs—a crucial stealth feature.

Stage 2: Delayed Trigger

The next time Python is invoked—whether through running a script, launching a test suite, starting a Jupyter notebook kernel, executing a CI job, or even running a package management command—the .pth file executes automatically. At this point, the malware downloads the Bun JavaScript runtime from GitHub and executes the bundled _index.js script.

As Socket researchers noted: "That means a compromised wheel can turn an otherwise passive dependency install into a delayed execution trigger."

This design is particularly insidious because the compromise occurs at install time but activation happens later, complicating incident response and making it harder to detect the initial infection.

## Scope and Targets

The campaign affected 37 malicious releases across 19 packages, all appearing to come from a single maintainer account. Collectively, these packages were downloaded hundreds of thousands of times, though the exact download count for each compromised version varies.

The affected bioinformatics packages are particularly concerning because they target the scientific and research community—environments where security tooling is often minimal and trust in open-source dependencies runs high.

### Credential Harvesting Targets

The JavaScript payload searches for and exfiltrates an extensive range of developer secrets:

| Secret Type | Examples |

|-------------|----------|

| Version Control | GitHub tokens, GitHub Actions secrets |

| Package Registry | npm, PyPI, RubyGems, JFrog publishing tokens |

| Cloud Platforms | AWS, GCP, Azure credentials |

| Container & Orchestration | Docker credentials, Kubernetes configs, HashiCorp Vault access |

| SSH & System | SSH keys, shell histories |

| Configuration Files | .env, .npmrc, .pypirc |

| AI/LLM Tools | Claude/MCP configuration files |

| Infrastructure | CI/CD secrets, workstation credentials |

This comprehensive targeting suggests the attackers understood modern development workflows and the value of stealing not just one credential type, but entire credential sets that could unlock multiple systems.

## Data Exfiltration and Evasion

The malware employs two distinct exfiltration channels:

Primary Method: GitHub Repositories

Stolen secrets are written to automatically-created GitHub repositories and exfiltrated via GitHub Actions. This method leverages legitimate infrastructure and blends malicious traffic with normal GitHub activity.

Secondary Method: HTTPS with Camouflage

A direct HTTPS exfiltration channel points to api[.]anthropic[.]com/v1/api—a deliberately crafted endpoint designed to masquerade as a legitimate Anthropic API call. Researchers believe this was intentional obfuscation to evade network monitoring.

### Evasion Techniques

The malware incorporates several defensive mechanisms:

## The Shai-Hulud Campaign Context

This attack is part of the broader "Shai-Hulud" supply chain campaign, which Socket has been tracking since earlier compromises. The campaign has now expanded to include 453 malicious artifacts, making it one of the most prolific and persistent software supply chain operations in recent memory.

Previous Shai-Hulud attacks have targeted:

The consistent use of JavaScript payloads, GitHub for exfiltration, and focus on stealing developer credentials suggests a coordinated group with deep knowledge of software development ecosystems.

## Implications for Organizations

The compromised packages pose several critical risks:

Immediate Risk: Any organization that installed affected package versions between the compromise date and discovery has potentially exposed developer credentials. If developers with elevated permissions were compromised, attackers could modify source code, access production systems, or inject malware into downstream software.

Supply Chain Propagation: Developers who use these compromised packages may unknowingly distribute the malware to their own projects and customers, creating a cascading compromise risk.

Long-Term Access: By exfiltrating CI/CD credentials, SSH keys, and cloud platform secrets, attackers gain persistent access to development and production infrastructure—potentially undetected for months.

Research Community Impact: Academic researchers and institutions relying on bioinformatics tools may face intellectual property theft, research compromise, or lateral movement into university networks and healthcare institutions.

## Recommendations

Organizations should take immediate action:

1. Identify Exposure

2. Rotate All Secrets

3. Restore from Backups

4. Detection

5. Long-Term Hardening

---

## HackWire Analysis

This attack exposes a critical weakness in how the open-source community manages trust. The Shai-Hulud campaign has now touched hundreds of packages with a consistent playbook: compromise a maintainer account, inject a multi-stage payload, and harvest wholesale access to development infrastructure. What makes this particular wave remarkable isn't the technical sophistication—it's the *scale and patience*.

By targeting bioinformatics tools, the attackers chose packages used primarily by researchers and scientists—communities with excellent security knowledge in their own domains but often less hardened development practices. These packages are trusted because they solve real problems. That trust becomes a vulnerability when supply chains can be compromised without triggering immediate suspicion.

The use of the Anthropic API endpoint for exfiltration is particularly telling. It suggests attackers are studying how defenders *think* legitimate traffic looks and deliberately mimicking it. A hardened network might flag unknown external APIs; mimicking a major AI provider's infrastructure blends in.

Most concerning: a developer who installed these packages weeks ago may not discover the compromise until a security audit, an anomalous cloud bill, or a detection in production reveals months of unauthorized access. The delayed execution mechanism means there's no immediate signal—just a quiet .pth file waiting to activate.

Organizations relying on PyPI must now choose between the security risk of using open-source packages and the operational cost of auditing supply chains. Without mandatory signed releases, package integrity verification, or robust dependency monitoring, that risk will only grow.

— HackWire Editorial

---

## Related Coverage