Shai-Hulud Attack Compromises 23 PyPI Packages Targeting MCP Developers

A second wave of malicious PyPI packages tied to the broader Shai-Hulud, Miasma, and Hades supply chain campaign added 23 newly identified package-version artifacts on top of the 37 malicious wheels documented in their weekend report.

According to Socket team, the expanded campaign now targets MCP (Model Context Protocol) developers, bioinformatics researchers, and Python developers who use popular frameworks such as LangChain, Flask, and OpenAI tooling.

What makes this wave particularly dangerous is that the threat actors are actively iterating on their delivery mechanisms rather than repeating the same pattern.

Shai-Hulud Wave Compromises 23 PyPI Packages

The campaign now operates through three distinct PyPI delivery branches:

• .pth startup-hook pattern — A malicious wheel drops a *-setup.pth file alongside a bundled _index.js payload, which executes at Python startup via the site module
• Trojanized native .abi3.so extensions — Used in the bioinformatics subcluster, where malicious code is compiled into native extensions and triggers the JavaScript payload silently at import time, bypassing source-only code review
• langchain-core-mcp loader variant — Ships without _index.js bundled; instead, its .pth hook scans all entries in Python’s sys.path to locate the payload elsewhere, splitting the loader and payload across packages to evade detection rules

The langchain-core-mcp@1.4.2 variant is especially notable. It installs a langchain_core-setup.pth startup hook that downloads the Bun JavaScript runtime from GitHub into a temp directory, then searches sys.path recursively for _index.js before executing it, it effectively functions as a staged supply chain loader even without a bundled payload.

The campaign targets two distinct developer communities. The bioinformatics subcluster trojanizes real packages used in scientific workflows, including embiggen, ensmallen, gpsea, phenopacket-store-toolkit, ppkt2synergy, and pyphetools.

A separate cluster includes MCP-themed packages like langchain-core-mcp, openai-mcp, instructor-mcp, tiktoken-mcp, and ray-mcp-server, alongside typosquat packages such as rsquests, tlask, and rlask mimicking requests and Flask.

The _index.js payload opens with a large JavaScript block comment stuffed with fake system instructions designed to confuse AI-assisted malware scanners and trigger LLM safety refusals before reaching the actual obfuscated code, Socket Threat Research said. 

The actual malicious code follows as a try{eval(...)} wrapper around obfuscated character-code arrays with ROT-style substitution. Traditional YARA rules, entropy checks, and AST parsing remain effective, but naive LLM-first scanning tools are vulnerable.

Once executed, the Hades-family stealer harvests GitHub tokens, npm/PyPI/RubyGems credentials, JFrog secrets, AWS/Azure/GCP cloud credentials, Kubernetes service account material, SSH keys, Docker configs, .env files, and shell histories from developer workstations and CI/CD runners.

The campaign tracker now covers 471 total affected artifacts, 411 npm artifacts across 106 packages, and 60 PyPI artifacts across 37 packages and continues to grow.

Indicators of Compromise

Confirmed malicious PyPI artifacts include:

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Defenders should audit Python environments for executable .pth files, unexpected _index.js files, Bun download logic, and newly added .abi3.so extensions.

In CI/CD pipelines, review runners for unusual workflow changes, Docker socket abuse, and access to publishing credentials. Rotate any tokens present in potentially compromised environments immediately.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.