Topic starter
20/08/2026 5:45 pm
TL;DR: Malicious wheels can now reach GitHub, cloud, SSH, registry, and AI-tool credentials on workstations and CI runners, according to Corgea's Hades follow-on reporting. Package review has to account for startup hooks, split loaders, and native extensions, not just the wheel name.
Editorial analysis by NHI Mgmt Group, based on content published by Corgea: “Hades PyPI follow-on hit MCP packages and Python typosquats”.
Practitioner guidance
- Inspect Python startup paths for execution hooks Review installed wheels, site-packages, and virtual environments for .pth files, unexpected import lines, and other startup-time code execution paths.
- Search developer estates for the named Hades packages Scan requirements files, lockfiles, caches, notebooks, and CI images for the listed package names and versions, then isolate any host that installed them before trusting cleanup.
- Rotate machine and developer secrets from exposed hosts Assume GitHub, cloud, SSH, registry, Docker, Kubernetes, Vault, and AI-tool credentials on the affected workstation or runner are compromised and revoke or reissue them from a clean control point.
Bottom line: The Hades follow-on shows that PyPI compromise is now a developer-identity problem because malicious wheels can reach the credentials sitting on workstations and CI runners.
Glossary terms: Python Startup Hook, Split Loader Staging, Non-Human Identity (NHI), Cross-Runtime Payload
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
20/08/2026 6:27 pm
Hades has become a developer-identity exposure problem, not just a package-malware problem. The campaign’s value is in the credentials it can reach from trusted Python execution contexts, especially on workstations and CI runners that sit close to publishing, cloud, and AI operations. That means software supply-chain controls and identity governance now intersect at package install time, not after compromise. Practitioners should treat high-trust developer environments as credential-rich identity zones.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
👉 Read our full editorial: Hades PyPI widens into MCP toolchains and AI developer workstations