Topic starter
20/08/2026 5:45 pm
TL;DR: The Hades PyPI campaign is shifting from niche scientific packages into MCP helpers, agent-adjacent libraries, and typo-squatted developer tools that commonly sit on workstations and CI runners with GitHub, cloud, SSH, registry, and AI-tool credentials, according to Corgea’s follow-on reporting. That pivot turns package installation into a broader credential-exposure problem, and trust in wheels, startup hooks, and AI-assisted triage now becomes part of the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Corgea: “Hades PyPI follow-on hit MCP packages and Python typosquats”.
Practitioner guidance
- Inspect Python startup paths for execution hooks Review installed wheels, site-packages, and virtual environments for .pth files, unexpected import lines, and other startup-time code execution paths.
- Search developer estates for the named Hades packages Scan requirements files, lockfiles, caches, notebooks, and CI images for the listed package names and versions, then isolate any host that installed them before trusting cleanup.
- Rotate machine and developer secrets from exposed hosts Assume GitHub, cloud, SSH, registry, Docker, Kubernetes, Vault, and AI-tool credentials on the affected workstation or runner are compromised and revoke or reissue them from a clean control point.
Bottom line: The Hades follow-on shows that PyPI compromise is now a developer-identity problem because malicious wheels can reach the credentials sitting on workstations and CI runners.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:27 pm
Hades has become a developer-identity exposure problem, not just a package-malware problem. The campaign’s value is in the credentials it can reach from trusted Python execution contexts, especially on workstations and CI runners that sit close to publishing, cloud, and AI operations. That means software supply-chain controls and identity governance now intersect at package install time, not after compromise. Practitioners should treat high-trust developer environments as credential-rich identity zones.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
👉 Read our full editorial: Hades PyPI widens into MCP toolchains and AI developer workstations