New Shai-Hulud Supply-Chain Attack Compromises 19 Science-Focused PyPI Packages

Security researchers have identified a new Shai-Hulud supply-chain campaign that compromised 19 packages on the Python Package Index, or PyPI, including several science and bioinformatics-focused projects collectively downloaded hundreds of thousands of times.

The attack was discovered by application security firm Socket and involved 37 malicious package releases tied to 19 packages that appear to have been controlled by a single maintainer. Many of the impacted packages are used in scientific computing, bioinformatics, imaging, and research workflows, including projects such as Dynamo, Spateo, CoolBox, U-FISH, and Napari-UFISH.

According to Socket, the compromised packages contained a malicious *-setup.pth file and an obfuscated JavaScript payload named _index.js. This delivery method is especially concerning because .pth files can be automatically processed when Python starts, allowing malicious code to execute after installation without requiring the user to directly run the compromised package.

In practice, that means a poisoned package can remain dormant until the next Python interpreter launch, pip command, test run, notebook session, CI job, or package-management operation. Once triggered, the malicious .pth file attempts to download the Bun JavaScript runtime from GitHub and then uses it to execute the bundled JavaScript payload.

Socket assessed the activity as part of the broader Shai-Hulud campaign because of similarities in behavior, tooling, and propagation techniques. With the latest findings, Socket now tracks more than 450 malicious artifacts connected to Shai-Hulud-related activity.

Analysis of the JavaScript payload shows that the malware is designed to harvest a wide range of developer and CI/CD secrets. Targeted data includes GitHub tokens, GitHub Actions secrets, npm tokens, PyPI credentials, RubyGems tokens, JFrog publishing keys, AWS credentials, Google Cloud credentials, Azure secrets, Kubernetes configuration data, Vault tokens, SSH keys, Docker credentials, .env files, .npmrc, .pypirc, shell history files, Claude and MCP configuration files, and other sensitive developer workstation data.

The goal appears to be broader compromise of software development environments. By stealing publishing credentials, repository tokens, and cloud secrets, attackers can potentially move from one compromised maintainer or developer environment into additional packages, repositories, CI/CD pipelines, cloud accounts, and downstream users.

The primary exfiltration method resembles previous Shai-Hulud activity. The malware attempts to create GitHub repositories and use GitHub Actions workflows to write stolen secrets into attacker-accessible locations. Researchers also observed a secondary HTTPS-based exfiltration method pointing to api[.]anthropic[.]com/v1/api, a legitimate-looking but invalid Anthropic API endpoint that may have been used as camouflage.

The malware includes several evasion and environment-checking features. It checks for Russian locale or environment indicators and looks for security tooling such as StepSecurity Harden-Runner. These checks may be intended to avoid certain systems, reduce detection, or identify hardened CI environments.

Persistence mechanisms were also observed. On Linux systems, the malware can create systemd services, while on macOS it can use LaunchAgents. The campaign also abuses GitHub workflow files and Claude/MCP configuration files, indicating that the operators are targeting both traditional development systems and newer AI-assisted development environments.

The attack highlights the growing risk of supply-chain compromise in scientific and open-source ecosystems. Research packages often run inside notebooks, lab systems, CI pipelines, and shared compute environments where API keys, cloud credentials, repository tokens, and unpublished research data may be present. A compromised dependency in that environment can create risk beyond the developer’s machine, especially if package installation occurs inside automated workflows.

Organizations that installed the affected package versions should treat the environment as potentially compromised. Recommended response actions include removing the malicious packages, rotating all developer and CI/CD secrets, auditing GitHub repositories and Actions workflows, reviewing cloud account activity, checking for suspicious systemd services or macOS LaunchAgents, and restoring affected environments from known-good backups where possible.

Defenders should also look for Python packages containing executable .pth startup hooks, unexpected downloads of the Bun runtime from GitHub, and process chains where Python launches Bun to execute _index.js. Additional indicators include unusual GitHub repository creation, unexpected GitHub Actions activity, new or modified CI secrets, suspicious access to package publishing accounts, and outbound connections to suspicious or disguised API endpoints.

The Shai-Hulud campaign reinforces a major software supply-chain lesson: package installation is no longer a passive action. In modern development environments, dependencies can execute code during installation, interpreter startup, testing, notebook initialization, or CI/CD execution. Security teams should monitor dependency behavior, restrict package publishing tokens, isolate build environments, enforce least-privilege credentials, and rotate secrets quickly when package compromise is suspected.