Multiple outlets report a continuing software supply-chain threat aimed at the Python Package Index (PyPI). The newly described “Hades” campaign is said to involve malicious artifacts published to PyPI, continuing an ongoing pattern of “Miasma”-related attacks that have evolved over time. According to the reports, the latest wave includes 37 compromised wheel files across 19 Python packages.
The malicious releases are described as using packaging mechanisms that trigger code execution when the packages are installed. One outlet specifically notes that the compromised distributions include a “*-setup.pth” file intended to run automatically, which can allow payload code to execute as part of the installation process rather than requiring users to explicitly invoke the attacker’s code.
Another outlet characterizes the activity as part of a persistent ecosystem-focused targeting effort, suggesting attackers refine their techniques and splinter campaigns to affect specific environments. While details of the full payload are not fully consistent across the excerpts, at least one report indicates the behavior aligns with a credential-stealing component associated with Bun (JavaScript runtime) environments. Overall, the sources agree the campaign is active, spread across multiple PyPI projects, and relies on malicious release artifacts designed for automatic execution.
