Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels

What Happened

A group of hackers is distributing malicious software packages through the Python Package Index (PyPI), specifically targeting developers working in bioinformatics and artificial intelligence. When a developer installs one of these compromised packages, hidden code secretly downloads a malicious program that steals passwords, cloud credentials, and source code. This matters because compromised developer accounts can lead to wider breaches within an organization's software supply chain. Organizations should review their Python environments for these specific malicious packages, rotate any potentially exposed credentials, and monitor their build systems for unusual activity.

Key Takeaways

• Threat actors are iterating on the Mini Shai-Hulud/Miasma campaign with 23 new malicious PyPI packages targeting bioinformatics and AI/MCP developers.
• The campaign utilizes three distinct delivery mechanisms: .pth startup hooks, trojanized native .abi3.so extensions, and a split-loader variant.
• The langchain-core-mcp variant evades standard detection by searching sys.path for its _index.js payload instead of bundling it directly.
• The malware payload includes a fake prompt-injection header designed to pollute and disrupt AI-assisted analysis tools.
• The Hades stealer targets developer workstations and CI/CD environments to harvest high-value secrets, including cloud credentials, SSH keys, and package registry tokens.

Affected Systems

• Python developer workstations
• CI/CD environments
• Linux
• macOS
• Windows

Attack Chain

The attack begins when a developer installs a malicious PyPI package. Depending on the package variant, execution is triggered either via a .pth startup hook or a trojanized native .abi3.so extension upon module import. The loader downloads the Bun runtime from GitHub, locates an obfuscated JavaScript payload (_index.js) either bundled or within sys.path, and executes it. The payload, protected by an LLM prompt-injection header to thwart AI analysis, then harvests credentials, SSH keys, and tokens from the developer's workstation or CI/CD environment.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Socket AI Scanner

The article mentions that Socket AI Scanner detects the malicious behavior, but no raw detection rules or queries are provided in the text.

Detection Engineering Assessment

EDR Visibility: Medium — EDR can observe Python spawning the Bun executable and subsequent network connections, but might miss the initial Python import-time execution if it blends with normal developer activity. Network Visibility: Medium — Network telemetry can capture the download of the Bun runtime from GitHub and subsequent C2 exfiltration, though the initial package download from PyPI appears legitimate. Detection Difficulty: Moderate — The split-loader technique and use of native extensions make static analysis difficult, but the behavioral chain of Python downloading and executing Bun is highly anomalous.

Required Log Sources

• Process Creation Logs (Event ID 4688 / Sysmon Event ID 1)
• File Creation Logs (Sysmon Event ID 11)
• Network Connection Logs (Sysmon Event ID 3)

Hunting Hypotheses

Control Gaps

• Static source code analysis tools that do not scan compiled .abi3.so native extensions.
• AI-assisted malware triage tools vulnerable to prompt injection.
• Scanners that expect loader and payload to be bundled in the same directory.

Key Behavioral Indicators

• Python process downloading Bun runtime.
• Python executing .pth files that search sys.path.
• Presence of LLM prompt injection strings in JavaScript comments.
• Python importing .abi3.so files that trigger external script execution.

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Verify against your organization's incident response runbook and team escalation paths before acting.
• Consider searching your Python environments and CI/CD pipelines for the specific malicious PyPI packages listed (e.g., langchain-core-mcp, embiggen).
• If any affected packages are found, evaluate whether to immediately rotate all potentially exposed credentials, including cloud tokens, SSH keys, and package registry tokens.

Infrastructure Hardening

• Evaluate whether to implement network egress filtering on CI/CD runners to block unexpected downloads, such as unauthorized runtimes from GitHub.
• Consider restricting access to the Docker socket (/var/run/docker.sock) on build runners to prevent abuse by malicious scripts.

User Protection

• If supported by your tooling, consider enforcing strict dependency pinning and hash-checking for all Python packages installed on developer workstations.
• Evaluate whether to use virtual environments with restricted permissions to limit the blast radius of compromised packages.

Security Awareness

• Consider training developers on the risks of typosquatting and the importance of verifying package names before installation.
• Evaluate whether to incorporate supply chain security awareness into existing developer training programs.

MITRE ATT&CK Mapping

• T1195.001 - Supply Chain Compromise: Software Dependencies and Development Tools
• T1059.006 - Command and Scripting Interpreter: Python
• T1059.007 - Command and Scripting Interpreter: JavaScript
• T1574 - Hijack Execution Flow
• T1552.001 - Credentials In Files
• T1562.001 - Impair Defenses: Disable or Modify Tools

Additional IOCs

• File Paths:
  • _index.js - Obfuscated JavaScript payload file searched for within sys.path by the loader.
  • .bun_ran - Run-once marker file created in the system temporary directory.
  • /tmp/.sshu-setup.js - SSH propagation file path used by the malware.
• Command Lines:
  • Purpose: Execute the discovered JavaScript payload using the downloaded Bun runtime. | Tools: Python, Bun | Stage: Execution | subprocess.run([bun_path, "run", payload], check=False)
• Other:
  • dreamgen - Malicious PyPI package artifact.
  • ensmallen - Malicious PyPI package artifact.
  • gpsea - Malicious PyPI package artifact.
  • instructor-mcp - Malicious PyPI package artifact.
  • mem8 - Malicious PyPI package artifact.
  • mflux-streamlit - Malicious PyPI package artifact.
  • openai-mcp - Malicious PyPI package artifact.
  • orchestr8-platform - Malicious PyPI package artifact.
  • phenopacket-store-toolkit - Malicious PyPI package artifact.
  • ppkt2synergy - Malicious PyPI package artifact.
  • pyphetools - Malicious PyPI package artifact.
  • ray-mcp-server - Malicious PyPI package artifact.
  • rlask - Malicious PyPI package artifact.
  • rsquests - Malicious PyPI package artifact.
  • tiktoken-mcp - Malicious PyPI package artifact.
  • tlask - Malicious PyPI package artifact.
  • thebeautifulmarchoftime - Fallback C2 discovery string.
  • thebeautifulsnadsoftime - Fallback C2 discovery string.