Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave Socket detected a coordinated PyPI compromise involving 37 malicious wheel artifacts across 19 packages, part of the Shai-Hulud/Miasma campaign that uses Python startup execution to download Bun and run an obfuscated JavaScript stealer targeting developer and CI/CD credentials. The attack marks a new Hades-themed branch of the same lineage, with 448 total artifacts now tracked across npm and PyPI. Socket detected a coordinated PyPI compromise involving 37 malicious wheel artifacts across 19 packages. The compromised releases shipped a -setup.pth file that attempts to execute automatically during Python startup, download the Bun JavaScript runtime, and run an obfuscated JavaScript payload named index.js . Socket’s AI malware detection system identified the malicious package cluster minutes after publication. The attack is cross-runtime, and the tradecraft is unmistakably Shai-Hulud / Miasma. Python packages provide the delivery vehicle, but the payload runs under Bun as a heavily obfuscated JavaScript stealer. That Bun dependency is a key fingerprint of this family: Shai-Hulud-style payloads do not assume Node.js, Python, or another local runtime will be available. Instead, they download and install Bun, then use it as the execution engine. That behavior has shown up even in npm compromises, where Node.js would otherwise be the expected runtime. Static deobfuscation of index.js mirrors what we have seen in compromised npm packages from the same lineage: a character-code and ROT-style eval wrapper, AES-GCM encrypted stages, rotated string tables, custom string decoders, and embedded AES/gzip-protected strings. Once unpacked, the payload targets the same high-value developer and CI/CD secret classes seen across Mini Shai-Hulud and Miasma waves, including GitHub, npm, PyPI, RubyGems, JFrog, CircleCI, Anthropic, AWS, GCP, Azure, Kubernetes, Vault, SSH keys, Docker configs, shell histories, .env files, .npmrc , .pypirc , Claude/MCP configs, and other local or runner-accessible credentials. The campaign marker changed. Earlier reporting tied the Red Hat Cloud Services wave to the Zelda-themed payload marker Miasma: The Spreading Blight , and other Shai-Hulud-related activity has used different thematic markers. The Shai-Hulud connection was first flagged to us on Bluesky https://bsky.app/profile/boredchilada.bsky.social/post/3mnldfffm2k2f by boredchilada https://cyfar.ca/ , an incident responder who tagged Socket shortly after the packages went live; our deobfuscation of index.js confirmed it, though with a new theme. Instead of Zelda references, this payload uses Hades-themed GitHub exfiltration markers, including the repository description Hades - The End for the Damned and generated repository-name components such as stygian , tartarean , cerberus , charon , styx , lethe , thanatos , and persephone . That makes Hades best understood as a PyPI branch of the same Mini Shai-Hulud / Miasma lineage, not a standalone Python malware incident. The core playbook remains the same: abuse trusted package channels, execute before normal package use, stage a Bun-powered JavaScript payload, steal developer and CI/CD credentials, and use GitHub-centric exfiltration and propagation logic. What changed is the ecosystem-specific trigger: this wave uses Python -setup.pth startup execution instead of npm preinstall or other npm install-time paths. The PyPI packages are the latest branch of this campaign that has moved quickly across open source ecosystems over the past few days. Socket is now tracking 448 affected artifacts across npm and PyPI, comprising 411 npm artifacts across 106 packages and 37 malicious PyPI wheels across 19 projects. At the time of writing, PyPI had already quarantined a number of the affected releases; we reported the remaining ones to the PyPI security team. We are tracking the full campaign on a dedicated page, with all affected artifacts added as they are identified: https://socket.dev/supply-chain-attacks/miasma-mini-shai-hulud-supply-chain-attack https://socket.dev/supply-chain-attacks/miasma-mini-shai-hulud-supply-chain-attack Affected PyPI packages Affected-PyPI-packages These 37 compromised artifacts span 19 PyPI packages from what looks like a single maintainer-account takeover. Consecutive patch releases were mass-published across the author's whole portfolio at once. The risk concentrates in a handful of established bioinformatics tools: dynamo-release the aristoteleo/dynamo single-cell RNA-velocity and expression-dynamics framework and its spatial-transcriptomics sibling spateo-release , coolbox GangCaoLab's Jupyter-based multi-omics genomic visualization toolkit for Hi-C/ChIP-Seq/RNA-Seq tracks , and the deep-learning FISH spot-detection tools ufish / napari-ufish . These are real and widely used research-community tools with cumulative download totals in the low-to-mid hundreds of thousands; they account for the large majority of the aggregate install base. The rest are low-traffic agent/task-execution, function-description, and lab-utility libraries — small footprints caught in the same blast rather than independently valuable targets. What the malicious wheels contained What-the-malicious-wheels-contained The malicious wheel pattern observed by Socket is simple and highly suspicious: