Topic starter
18/08/2026 2:50 pm
TL;DR: Multiple PyPI packages were compromised with a Bun-based loader, cross-platform memory scrapers, GitHub-backed C2, and AI analyst misdirection, turning package import into a multi-stage supply chain foothold, according to StepSecurity. The pattern shows why secrets exposure, runner memory access, and automated triage trust boundaries now need joint governance, not isolated controls.
Editorial analysis by NHI Mgmt Group, based on content published by StepSecurity: “The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent”.
Key questions
Q: What fails first when a malicious PyPI package executes at import time?
A: The first failure is the assumption that package installation is separate from code execution.
Q: Why do runner memory reads create such a serious secret exposure risk?
A: Because workflow tokens and injected credentials often exist in memory even when they are never written to disk.
Q: What do security teams get wrong about AI-driven alert triage?
A: They often focus on speed and ignore governance.
Practitioner guidance
- Harden package import paths Block or sandbox packages that execute substantial logic during import, especially when the package also fetches runtimes or secondary payloads.
- Reduce secret residency in runners Keep workflow tokens, cloud credentials, and SSH material out of jobs that do not strictly need them, because in-memory access is enough for theft.
- Isolate AI-assisted triage from raw malicious content Feed LLM review systems sanitised extracts and enforce deterministic verdict checks so prompt injection inside code cannot steer the final analysis.
Bottom line: This campaign shows that a single PyPI dependency can bridge package execution, runner memory access, GitHub-based operator channels, and analyst deception in one chain.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:32 pm
Package import has become a privilege boundary, not just a software distribution step. This campaign shows that importing a dependency can execute code, download a runtime, and pivot into memory scraping before a human sees anything unusual. For identity programmes, the key question is which secrets, service accounts, and workflow identities are allowed to exist in that execution path at all. Practitioner conclusion: govern import-time behaviour as part of identity and secrets policy.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern package provenance when GitHub and PyPI are both in play?
A: They should track where a package came from, how it was imported, and which developer or workflow identities were exposed along the way. When public infrastructure is used for both delivery and command and control, provenance and runtime trust must be evaluated together instead of as separate reviews.
👉 Read our full editorial: Hades campaign shows how PyPI supply chain malware now targets AI triage