Notifications
Clear all
Topic starter
09/06/2026 11:00 pm
TL;DR: A coordinated PyPI supply chain attack has compromised 26 packages and 37 malicious wheel files, used Python startup hooks to run cross-runtime malware, and harvested cloud tokens, Kubernetes secrets, GitHub credentials, and AI assistant data across 14 systems, according to Orca Security. The lesson is that package trust, startup execution, and secret exposure must be governed as one identity problem, not separate controls.
NHIMG editorial — based on content published by Orca Security: Hades campaign supply chain attack on PyPI packages
By the numbers:
- A coordinated supply chain attack targeting PyPI has compromised 26 packages (37 malicious wheel files) across bioinformatics, graph ML, deep-learning, and developer tooling ecosystems.
- The payload targets secrets across 14 systems, including AWS, GCP, Azure, Kubernetes, GitHub, PyPI, npm, RubyGems, SSH, Docker, .env files, shell histories, and AI assistant configurations.
Questions worth separating out
Q: What breaks when a compromised Python package can run code at interpreter startup?
A: Package trust breaks down because the code runs before a developer or pipeline explicitly imports anything.
Q: Why do stolen publishing credentials make supply chain attacks worse?
A: Publishing credentials turn a one-time compromise into a propagation event.
Q: How can security teams tell whether secret exposure has become a propagation risk?
A: Look for credential access that can reach package publishing systems, source control, CI, or cloud control planes from the same environment.
Practitioner guidance
- Remove or pin away from affected package versions immediately Identify installations of the compromised releases, block them at the repository or lockfile level, and rebuild affected developer workstations and CI runners where possible.
- Rotate all exposed credentials in dependency and build paths Prioritise GitHub tokens, package registry publishing credentials, cloud provider tokens, Kubernetes secrets, SSH keys, and Docker registry credentials.
- Hunt for persistence artifacts across endpoints and launch agents Search for the named service files, lock files, and repository naming patterns tied to this campaign, then validate whether unauthorized commits or workflow modifications occurred.
What's in the full article
Orca Security's full research covers the operational detail this post intentionally leaves for the source:
- Package-by-package breakdown of the affected PyPI releases and their malicious wheel files
- File and process indicators tied to the campaign, including persistence paths and lock artifacts
- Detection and response detail for teams that need to hunt exposed tokens across cloud, GitHub, and registry systems
- Runtime and asset-prioritisation guidance for environments that need to scope exposure beyond a static package list
👉 Read Orca Security's analysis of the Hades PyPI supply chain campaign →
PyPI supply chain attacks and cloud credential theft: what teams need to know?
Explore further
10/06/2026 1:11 am
Package trust is now an identity control, not a software distribution preference. The campaign shows that installation-time code execution can convert a benign dependency into a credential collection platform before any application logic runs. That means package governance, publishing rights, and runtime trust are part of the same control plane. Practitioners should treat dependency intake as identity exposure management, not only as vulnerability triage.
A few things that frame the scale:
- The attack sends decoy traffic to Anthropic AI servers to confuse network-level analysis, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Our research also shows that the average estimated time to remediate a leaked secret is 27 days, which is long enough for stolen credentials to be reused in a live campaign.
A question worth separating out:
Q: What should teams do after a package supply chain compromise is detected?
A: Contain first, then rotate. Isolate the affected hosts, remove or pin the malicious versions, hunt for persistence artifacts, and rebuild systems where possible before credential rotation. That sequence matters because revoking secrets too early can trigger deterrence logic or simply push the attacker to another compromised environment.
👉 Read our full editorial: Hades campaign shows how PyPI supply chain attacks steal cloud credentials
