Hades campaign shows how PyPI supply chain malware now targets AI triage

At a glance

What this is: This is a supply chain threat analysis showing how compromised PyPI packages can execute on import, scrape runner memory across operating systems, and evade AI-assisted review.

Why it matters: It matters to IAM and NHI teams because the campaign targets the same assets identity programmes rely on most, including tokens, SSH keys, OIDC trust, and workload secrets.

By the numbers:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.

👉 Read StepSecurity's analysis of the Hades PyPI supply chain campaign

Context

PyPI supply chain compromise is no longer limited to code execution inside a single environment. The Hades Campaign shows how a malicious package can move from import-time execution to secret theft, cross-platform memory scraping, and downstream control of developer and CI/CD trust relationships, which is exactly where identity governance becomes operationally relevant.

The security gap is not just malicious code in a package. It is the combination of developer workstation access, runner memory exposure, OIDC trust, and overextended secrets lifecycles that lets one package touch many identity types at once. That makes the campaign a useful case study for NHI governance, workload identity, and credential containment.

The starting position here is increasingly typical for modern supply chain attacks: one compromised package can become an identity event, a cloud event, and a developer trust event at the same time.

Key questions

Q: What breaks when a compromised package executes during import in CI/CD pipelines?

A: Import-time execution collapses the usual separation between dependency loading and code execution. Once the package runs on import, it can read environment variables, load companion payloads, and start secondary behaviour before most scanners or approval gates have any chance to intervene. The control failure is trusting package installation or import as a safe, passive step.

Q: Why do memory scrapers remain effective even when secrets are short-lived?

A: Short-lived secrets still exist in memory long enough to be stolen if the attacker can execute inside the same process context. Build runners and developer tools often inject high-value credentials into runtime memory for convenience, so duration alone does not remove risk. The real issue is whether process memory is protected as a governed secret surface.

Q: What do security teams get wrong about AI-driven alert triage?

A: They often focus on speed and ignore governance. Faster triage is useful only if the reasoning is explainable, the evidence is retained, and analysts can override the result. Without those controls, AI simply accelerates both good decisions and bad ones.

Q: How should organisations respond when GitHub tokens or SSH keys may be exposed?

A: Contain first, then revoke in a controlled sequence that preserves evidence. Teams should invalidate tokens, rotate dependent credentials, inspect public repositories for exfiltration markers, and search for backdoors in developer workspaces and workflows. The goal is to close persistence paths before the attacker can repurpose stolen access.

Technical breakdown

How the import-time loader turns package execution into a foothold

The first mechanism is a Python import hook embedded in __init__.py, which runs as soon as the package is imported. That hook checks for a local marker file, locates a companion _index.js payload, downloads Bun if needed, and then executes the JavaScript bundle. This matters because the attacker does not need a separate installer, a post-install script, or a visible shell command. Package import itself becomes the execution boundary, which is especially dangerous in developer tooling and CI jobs that treat imports as routine.

Practical implication: treat package import as an execution event and inspect dependency behaviour before code reaches developer workstations or runners.

Why cross-platform memory scraping changes the defender model

The campaign moves beyond filesystem theft and targets process memory on Linux, macOS, and Windows. On each platform, the malware reads the Runner.Worker address space to collect plaintext secrets that may only exist in memory for the duration of a job. That bypasses controls that focus on disk artefacts alone. Once secrets are injected into a build context, memory becomes the attack surface, and platform-specific APIs such as /proc memory access, Mach VM calls, or Win32 ReadProcessMemory give attackers a direct path to high-value tokens.

Practical implication: monitor runner memory access and process-level behaviour, not only file and network events, when protecting CI/CD secrets.

How AI analyst misdirection exploits trust in automated triage

The novel twist is prompt injection placed at the top of the payload to influence LLM-based malware analysis. Instead of trying to hide code from static scanners, the attacker tries to shape the model's output so the package is classified as benign. This is an emerging governance problem for AI-assisted security workflows: the model is being used as a decision layer, so adversarial text can become a control bypass. The threat is not that the LLM is wrong in the abstract, but that downstream processes may trust its output too much.

Practical implication: isolate untrusted content from model prompts and require deterministic checks before any LLM-generated verdict is accepted.

Threat narrative

Attacker objective: The objective is to steal reusable credentials at scale, maintain persistence across developer and CI environments, and preserve access long enough to expand compromise and exfiltrate data.

1. Entry occurs when a developer or CI runner imports a compromised PyPI package that executes a hidden loader during package initialization.
2. Credential access follows through cross-platform memory scraping, GitHub token harvesting, OIDC trust abuse, and collection of SSH keys and cloud secrets.
3. Escalation and lateral movement occur as the malware republishes stolen tokens, plants backdoors, and attempts self-replication across repositories and developer systems.
4. Impact is broader account compromise, persistent access, exfiltration, and the threat of destructive retaliation if defenders revoke access too quickly.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Supply chain compromise is now an identity event, not just a software event. The Hades Campaign shows that one malicious package can touch tokens, SSH keys, runner credentials, and OIDC trust in a single execution path. That collapses the boundary between software provenance and identity governance, because the attacker is really after the credentials that make systems operational. Practitioners should treat dependency intake as part of identity risk management, not just application security.

Ephemeral execution does not remove credential risk when secrets are injected into memory. The campaign targets memory because many build and automation systems still rely on short-lived but highly privileged secrets during runtime. That creates a standing exposure window inside the process, even when the credential never lands on disk. This is the kind of failure mode OWASP Non-Human Identity Top 10 is designed to surface, especially where rotation, scope, and runtime containment are not aligned.

AI-assisted malware triage introduces a new trust boundary that defenders are not yet governing consistently. The prompt injection used here is a named concept worth tracking: analyst misdirection payloads. These are malicious artefacts crafted to influence automated review rather than evade static parsing alone. The governance lesson is straightforward: if LLM output can affect quarantine, escalation, or approval, then the model itself becomes part of the control plane and needs deterministic guardrails.

Self-replication across repositories and developer environments widens the blast radius faster than most secrets programmes can absorb. This campaign combines GitHub search, commit-based C2, backdoored workspace files, and repo planting to turn one compromise into many. That pattern complicates lifecycle management because offboarding one token or one account does not close the propagation path. Teams should map these techniques to cloud and developer control frameworks, not assume normal dependency review will catch them.

Destructive deterrence signals a shift from stealth-only malware to coercive access retention. The wiper monitoring component is meant to discourage immediate revocation, which means defenders are now facing psychological as well as technical pressure during incident response. For IAM and PAM teams, the lesson is to pre-stage revocation and containment playbooks so access removal can happen before the attacker can convert stolen credentials into leverage.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• For adjacent guidance: Review 52 NHI Breaches Analysis for recurring credential abuse patterns, then map them against the OWASP Non-Human Identity Top 10.

What this signals

The practical signal for security programmes is that supply chain defence now needs to span source, runner, and identity layers at once. If a package can steal tokens from memory, abuse OIDC trust, and plant persistence in developer tooling, then your control architecture has to combine software provenance checks with credential containment and identity-aware runtime monitoring.

Analyst misdirection payloads: malicious artefacts designed to manipulate LLM-based security workflows are likely to increase as more teams use AI for triage. That means review pipelines need strict prompt boundaries, signature verification, and deterministic policy enforcement before model output can influence action. Teams that rely on AI summaries without a control backstop will create a new evasion channel.

For identity teams, the bigger lesson is that secrets lifecycle and developer environment governance are converging. The same runtime that compiles code can also mint, store, and exfiltrate credentials, which is why links between workload identity, runner hardening, and secret revocation need to be managed as one programme rather than separate tickets.

For practitioners

• Segment package import from execution trust Block direct import of newly introduced or version-pinned packages until they pass deterministic checks in isolated sandboxes. Treat __init__.py execution, native build hooks, and bundled runtimes as equivalent to code execution in your intake process.
• Inspect runner memory access as a control objective Add telemetry for process memory reads, suspicious API use, and unusual child processes inside CI/CD runners. Memory scraping of Runner.Worker will bypass file-based secret scanning unless runtime controls watch the process boundary.
• Constrain OIDC minting paths in build systems Review workflows that can mint registry or cloud tokens through OIDC and reduce the audience scope wherever possible. GitHub Actions identity trust should be treated as a high-value pathway that can be abused for package publication and persistence.
• Separate model output from security decisions If AI tools are used in malware or package triage, keep their output advisory only. Require signature checks, policy rules, and human verification before any verdict is used to allow, block, or quarantine software.
• Pre-stage revocation for compromised developer credentials Maintain tested procedures for revoking GitHub tokens, SSH keys, cloud credentials, and runner secrets in parallel. The campaign’s deterrence logic depends on slow response, so containment speed is part of the security control.

Key takeaways

• Compromised PyPI packages can now act as full compromise platforms, not just code execution vectors, because they target memory, identity trust, and persistence together.
• The campaign shows that secrets in runtime memory remain vulnerable even when they are short-lived, and AI-assisted triage can be actively manipulated by malicious content.
• Practitioners should tighten package intake, isolate model-assisted review, and treat credential revocation as an operational race, not a background hygiene task.

Key terms

• Import-time execution: Import-time execution is code that runs when a Python module is loaded rather than when a user deliberately calls a function. That behaviour matters in security reviews because it can trigger secret access, network calls, or persistence before an application has meaningfully started operating.
• Runner Memory Scraping: The technique of reading process memory on a build or CI runner to extract credentials, tokens, or plaintext secrets that were never written to disk. It is effective because many pipelines inject sensitive values into runtime memory for legitimate work, creating a high-value target inside the process boundary.
• Analyst Misdirection Payload: Malicious content designed to influence automated analysis systems, especially LLM-based triage, by shaping the model's interpretation of surrounding code or text. The goal is to cause false confidence, weaken escalation, or suppress detection, making the review pipeline itself part of the attack surface.
• OIDC Trust Policy: A rule set that allows a workload or pipeline to exchange an assertion for temporary cloud credentials. The policy defines who can assume the role, from where, and under what conditions, which makes it a critical control point for preventing token abuse.

What's in the full report

StepSecurity's full blog covers the operational detail this post intentionally leaves for the source:

• Detailed deobfuscation of the Bun-based loader and the Python import hook used to trigger execution.
• Full indicators of compromise for the lock files, state files, persistence scripts, and exfiltration repository patterns.
• Package-by-package affected version list and campaign timeline for incident response teams.
• Harden-Runner detection and lockdown behaviour, including step-level runtime signals seen during memory scraping.

👉 StepSecurity's full post covers the attack chain, indicators of compromise, and response details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It gives identity and security practitioners a practical way to connect runtime access, credential lifecycle, and governance controls.