PyPI supply chain malware and AI triage evasion: what teams need to know

TL;DR: Multiple PyPI packages were compromised with a Bun-based loader, cross-platform memory scrapers, GitHub-backed C2, and AI analyst misdirection, turning package import into a multi-stage supply chain foothold, according to StepSecurity. The pattern shows why secrets exposure, runner memory access, and automated triage trust boundaries now need joint governance, not isolated controls.

NHIMG editorial — based on content published by StepSecurity: The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent

Questions worth separating out

Q: What breaks when a compromised package executes during import in CI/CD pipelines?

A: Import-time execution collapses the usual separation between dependency loading and code execution.

Q: Why do memory scrapers remain effective even when secrets are short-lived?

A: Short-lived secrets still exist in memory long enough to be stolen if the attacker can execute inside the same process context.

Q: What do security teams get wrong about AI-driven alert triage?

A: They often focus on speed and ignore governance.

Practitioner guidance

• Segment package import from execution trust Block direct import of newly introduced or version-pinned packages until they pass deterministic checks in isolated sandboxes.
• Inspect runner memory access as a control objective Add telemetry for process memory reads, suspicious API use, and unusual child processes inside CI/CD runners.
• Constrain OIDC minting paths in build systems Review workflows that can mint registry or cloud tokens through OIDC and reduce the audience scope wherever possible.

What's in the full report

StepSecurity's full blog covers the operational detail this post intentionally leaves for the source:

• Detailed deobfuscation of the Bun-based loader and the Python import hook used to trigger execution.
• Full indicators of compromise for the lock files, state files, persistence scripts, and exfiltration repository patterns.
• Package-by-package affected version list and campaign timeline for incident response teams.
• Harden-Runner detection and lockdown behaviour, including step-level runtime signals seen during memory scraping.

👉 Read StepSecurity's analysis of the Hades PyPI supply chain campaign →

PyPI supply chain malware and AI triage evasion: what teams need to know?

Explore further

View Full Forum →  |  NHI Foundation Course →