Hades campaign shows how PyPI supply chain malware now targets AI triage

At a glance

What this is: StepSecurity’s analysis of the Hades campaign shows compromised PyPI packages delivering cross-platform memory scrapers, GitHub-based command and control, and prompt injection aimed at confusing AI security triage.

Why it matters: IAM, PAM, and DevSecOps teams need to treat package ingestion, runner memory, and AI-assisted review as one trust boundary because this campaign shows attackers are targeting all three at once.

Context

PyPI supply chain compromise is no longer just about malicious install-time code. This campaign shows how a package import can become a bridge into CI/CD memory, developer credentials, and even the analysis pipeline that is supposed to catch abuse.

The security gap is not a lack of scanning alone. It is the assumption that package inspection, runtime controls, and analyst review can be governed independently when the attack chain is deliberately built to cross each boundary.

For IAM and NHI programmes, the important detail is that the malware goes after injected tokens, SSH keys, cloud credentials, and workflow secrets, then uses those same identities and secrets to spread and persist.

Key questions

Q: What fails first when a malicious PyPI package executes at import time?

A: The first failure is the assumption that package installation is separate from code execution. If a package can run during import, it can fetch helpers, inspect the runtime, and reach secrets before conventional review or endpoint controls have a chance to intervene. Teams need controls that inspect package behaviour before execution, not after.

Q: Why do runner memory reads create such a serious secret exposure risk?

A: Because workflow tokens and injected credentials often exist in memory even when they are never written to disk. A process with the same user context can copy that memory and recover usable secrets without triggering file-based detection. That makes memory residency a governance issue, not just a runtime performance detail.

Q: What do security teams get wrong about AI-driven alert triage?

A: They often focus on speed and ignore governance. Faster triage is useful only if the reasoning is explainable, the evidence is retained, and analysts can override the result. Without those controls, AI simply accelerates both good decisions and bad ones.

Q: How should teams govern package provenance when GitHub and PyPI are both in play?

A: They should track where a package came from, how it was imported, and which developer or workflow identities were exposed along the way. When public infrastructure is used for both delivery and command and control, provenance and runtime trust must be evaluated together instead of as separate reviews.

Technical breakdown

How a PyPI import becomes an execution bridge

The campaign embeds its first-stage logic inside a package __init__.py file so code executes during import, not after a user manually runs a separate payload. The hook locates a companion JavaScript bundle, downloads a Bun runtime if needed, and then launches the payload from temporary storage. That matters because package managers and dependency review processes often focus on installation metadata, not on what a package executes once imported. The result is a delivery path that looks like normal developer activity but behaves like runtime code execution.

Practical implication: treat import-time execution as a control point and inspect package behaviour before it reaches developer or CI runtime.

Why cross-platform memory scraping defeats traditional secret handling

The payload is designed to read process memory on Linux, macOS, and Windows runners so it can recover plaintext tokens and environment secrets without writing them to disk. On Linux it reads /proc mappings and memory directly, while on macOS and Windows it uses native OS APIs to query and copy another process’s memory space. This is a shift from file theft to address-space theft. Secrets injected into a workflow still exist briefly in memory, and that ephemeral exposure window is enough for the malware to harvest them.

Practical implication: reduce secret residency in runner memory and restrict which identities ever reach build and analysis jobs.

How prompt injection targets AI triage and GitHub-based C2

The campaign adds plain-text instructions at the top of the malicious bundle to influence LLM-based scanners, effectively turning the analyzer into part of the attack surface. At the same time, its command-and-control logic uses GitHub commits, signatures, and search queries so operator messages blend into ordinary developer activity. That combination makes the malware harder to separate from legitimate code and harder for automated summarisation systems to classify correctly. The security problem is no longer just malicious code, but malicious code shaped to manipulate the review system itself.

Practical implication: isolate raw code from AI prompts and validate triage outputs against deterministic scanners and policy checks.

Threat narrative

Attacker objective: The attacker wants to harvest credentials, maintain access across developer and CI environments, and evade both human and AI-driven detection long enough to expand the compromise.

1. Entry begins when a compromised PyPI package is imported and its obfuscated __init__.py hook launches a Bun-backed payload.
2. Credential access follows as the malware scrapes runner and developer process memory to collect injected tokens, SSH keys, and other secrets.
3. Lateral movement and persistence are reinforced through GitHub-backed C2, repo backdoors, and self-replication across developer systems.
4. Impact is achieved by enabling long-lived access, secret exfiltration, and the possibility of destructive pressure through the wiper deterrent.

Breaches seen in the wild

• PyPI secrets exposure 2023: Researchers found 3,938 unique secrets in published PyPI packages, 768 still valid; a new release or yank does not remove them.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Package import has become a privilege boundary, not just a software distribution step. This campaign shows that importing a dependency can execute code, download a runtime, and pivot into memory scraping before a human sees anything unusual. For identity programmes, the key question is which secrets, service accounts, and workflow identities are allowed to exist in that execution path at all. Practitioner conclusion: govern import-time behaviour as part of identity and secrets policy.

Prompt injection is now a supply chain defence problem, not only an AI safety problem. The malicious bundle is written to influence LLM-based triage systems, which means the attacker is actively targeting the review control plane. That creates a governance gap between static malware detection and AI-assisted summarisation, where the latter can be manipulated into false reassurance. Practitioner conclusion: treat AI review outputs as untrusted until validated by independent controls.

Cross-platform memory scraping exposes the weakness of secret-in-memory assumptions. The malware does not need to steal files if it can read runner memory while secrets are present there. That breaks the common assumption that ephemeral workload credentials are safe simply because they are never written to disk. Practitioner conclusion: shorten secret residency and limit the identities that ever enter runner memory.

Hades illustrates a new trust collapse between package ecosystems, developer tooling, and GitHub-native operator channels. The campaign uses public infrastructure for C2, self-replication, and token exfiltration, which makes the attack look like normal developer workflow traffic. That is a governance problem for NHI, CI/CD, and platform teams alike because the malicious activity sits inside trusted collaboration systems. Practitioner conclusion: rebuild trust decisions around provenance, not platform familiarity.

AI triage evasion is the named concept this campaign sharpens. The malware is engineered to confuse the security workflow that classifies it, not just to bypass endpoint controls. That makes the analyst pipeline itself a target and raises the bar for all package-security review processes. Practitioner conclusion: separate code ingestion, LLM analysis, and final disposition into independently verifiable stages.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: AI Supply Chain Security and AI-BOM Guide

What this signals

AI triage evasion is becoming a repeatable supply chain tactic. Security teams should expect attackers to shape payloads for the review system as much as for the runtime. The practical response is to separate code parsing, LLM summarisation, and final acceptance so that a single malicious prompt cannot control the decision chain.

Pipeline identity now extends beyond build permissions. The identities that matter are not only the package publisher and the runner service account, but also the analyst workflow that inspects the package. If that workflow can be manipulated, the control gap sits inside governance, not just tooling.

StepSecurity’s analysis is a warning that supply chain security, NHI governance, and AI review controls are converging in the same attack path. Organisations that still handle them as separate programmes will keep missing the point of the compromise.

For practitioners

• Harden package import paths Block or sandbox packages that execute substantial logic during import, especially when the package also fetches runtimes or secondary payloads.
• Reduce secret residency in runners Keep workflow tokens, cloud credentials, and SSH material out of jobs that do not strictly need them, because in-memory access is enough for theft.
• Isolate AI-assisted triage from raw malicious content Feed LLM review systems sanitised extracts and enforce deterministic verdict checks so prompt injection inside code cannot steer the final analysis.
• Monitor developer devices and repos for package compromise Search enrolled machines, repositories, and pull requests for the affected package names and versions, then trace where compromised dependencies entered the estate.

Key takeaways

• This campaign shows that a single PyPI dependency can bridge package execution, runner memory access, GitHub-based operator channels, and analyst deception in one chain.
• The practical danger is not only malware execution but the theft of in-memory secrets from developer and CI identities that were assumed to be transient.
• Controls that stop at installation checks will miss the attack unless they also cover provenance, runner memory, and the trust boundary around AI-assisted triage.

Key terms

• Supply Chain Malware: Malware delivered through trusted software distribution paths such as packages, dependencies, or build tooling. It succeeds by inheriting trust from legitimate workflows, which makes publication-time checks insufficient if the malicious behaviour appears only after install or in a later version.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Runner Memory Scraping: The technique of reading process memory on a build or CI runner to extract credentials, tokens, or plaintext secrets that were never written to disk. It is effective because many pipelines inject sensitive values into runtime memory for legitimate work, creating a high-value target inside the process boundary.
• GitHub-based Command and Control: A control channel that uses GitHub commits, repositories, or API searches to deliver operator instructions, payloads, or exfiltrated data. This blends malicious traffic into a legitimate developer platform and makes detection harder when defenders rely on reputation alone.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course, the industry's only accredited NHI security programme, to strengthen governance for machine identities, secrets management, and agentic AI.