Notifications
Clear all
Topic starter
18/08/2026 2:50 pm
TL;DR: Multiple PyPI packages were compromised with a Bun-based loader, cross-platform memory scrapers, GitHub-backed C2, and AI analyst misdirection, turning package import into a multi-stage supply chain foothold, according to StepSecurity. The pattern shows why secrets exposure, runner memory access, and automated triage trust boundaries now need joint governance, not isolated controls.
NHIMG editorial — based on content published by StepSecurity: The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
Questions worth separating out
Q: What breaks when a compromised package executes during import in CI/CD pipelines?
A: Import-time execution collapses the usual separation between dependency loading and code execution.
Q: Why do memory scrapers remain effective even when secrets are short-lived?
A: Short-lived secrets still exist in memory long enough to be stolen if the attacker can execute inside the same process context.
Q: What do security teams get wrong about AI-driven alert triage?
A: They often focus on speed and ignore governance.
Practitioner guidance
- Segment package import from execution trust Block direct import of newly introduced or version-pinned packages until they pass deterministic checks in isolated sandboxes.
- Inspect runner memory access as a control objective Add telemetry for process memory reads, suspicious API use, and unusual child processes inside CI/CD runners.
- Constrain OIDC minting paths in build systems Review workflows that can mint registry or cloud tokens through OIDC and reduce the audience scope wherever possible.
What's in the full report
StepSecurity's full blog covers the operational detail this post intentionally leaves for the source:
- Detailed deobfuscation of the Bun-based loader and the Python import hook used to trigger execution.
- Full indicators of compromise for the lock files, state files, persistence scripts, and exfiltration repository patterns.
- Package-by-package affected version list and campaign timeline for incident response teams.
- Harden-Runner detection and lockdown behaviour, including step-level runtime signals seen during memory scraping.
👉 Read StepSecurity's analysis of the Hades PyPI supply chain campaign →
PyPI supply chain malware and AI triage evasion: what teams need to know?
Explore further
18/08/2026 3:32 pm
Supply chain compromise is now an identity event, not just a software event. The Hades Campaign shows that one malicious package can touch tokens, SSH keys, runner credentials, and OIDC trust in a single execution path. That collapses the boundary between software provenance and identity governance, because the attacker is really after the credentials that make systems operational. Practitioners should treat dependency intake as part of identity risk management, not just application security.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How should organisations respond when GitHub tokens or SSH keys may be exposed?
A: Contain first, then revoke in a controlled sequence that preserves evidence. Teams should invalidate tokens, rotate dependent credentials, inspect public repositories for exfiltration markers, and search for backdoors in developer workspaces and workflows. The goal is to close persistence paths before the attacker can repurpose stolen access.
👉 Read our full editorial: Hades campaign shows how PyPI supply chain malware now targets AI triage
