New Shai-Hulud attack trojanizes 19 science-focused PyPI packages
Attackers tainted 19 PyPI packages, many used in bioinformatics, to steal developer secrets and spread through build and CI workflows.
Intelligence analysis by GPT-5.4 Mini
Socket says a new Shai-Hulud supply-chain campaign compromised 19 PyPI packages, including popular science and bioinformatics tools, and used malicious startup hooks to run code that steals secrets from developer systems and CI environments.
Attackers hid a tiny trap inside trusted science software packages. When a computer starts Python, the trap can wake up, steal keys and passwords, and send them away, like hiding a thief inside a toolbox.
Analysis
What happened
Socket reported that attackers compromised 19 PyPI packages in a new Shai-Hulud supply-chain campaign. The affected releases totaled 37 malicious artifacts and appeared to come from a single maintainer. Several of the packages are science and bioinformatics tools, including Dynamo, Spateo, CoolBox, U-FISH, and Napari-UFISH.
How the malware worked
The malicious packages included a *-setup.pth file and an obfuscated JavaScript file called _index.js. The .pth file is important because Python can process it automatically when Python starts, which means the payload may run later than the original install and in ordinary workflows such as test runs, notebook sessions, CI jobs, or package-management commands. Socket says the code then tries to fetch the Bun JavaScript runtime from GitHub and use it to execute the bundled script.
What it targeted
Socket says the payload was built to harvest a broad set of developer secrets: GitHub tokens, GitHub Actions secrets, npm, PyPI, RubyGems, and JFrog publishing tokens, cloud credentials for AWS, GCP, Azure, Kubernetes, and Vault, SSH keys, Docker credentials, shell history, .env-style files, and Claude/MCP configuration files.
Why defenders care
The report says the campaign uses the same broad playbook seen in earlier Shai-Hulud activity: steal credentials, then use them to spread further through development workflows. Socket also noted a GitHub-based exfiltration path, plus a direct HTTPS path that pointed to a legitimate but invalid Anthropic API endpoint, which it считает was likely camouflage. It also observed checks for Russian locales and for tools such as StepSecurity Harden-Runner, plus persistence through systemd on Linux and LaunchAgents on macOS.
Socket recommends rotating all secrets and restoring affected environments from safe backups. It also advises hunting for executable .pth startup hooks, unexpected Bun downloads from GitHub, and process chains where Python launches Bun to run _index.js.
Key points
- Socket says 19 PyPI packages were compromised in a new Shai-Hulud supply-chain campaign.
- The affected packages included popular bioinformatics tools and had hundreds of thousands of downloads.
- The malware used a `.pth` startup hook and an obfuscated JavaScript payload to run code when Python started.
- The payload targeted many developer secrets, including cloud, GitHub, package, SSH, and Docker credentials.
- Socket recommends rotating secrets and restoring affected environments from safe backups.
If organizations follow Socket’s guidance, they can rotate exposed secrets, restore clean systems from backups, and cut off the attacker’s access quickly. The detection clues in the report may also help security teams find and remove the malicious packages before more systems are affected.
If the compromised packages were already installed in developer laptops or CI pipelines, the attackers may have harvested credentials that unlock code repositories, cloud accounts, or deployment systems. Because the malware can run on later Python starts, the compromise may linger until teams identify every affected environment and rebuild it.
