Hades Hits PyPI: 37 Poisoned Wheels Auto-Exec via .pth Trick

Another week, another fork of the Shai-Hulud lineage. This time it's Hades, a new wave inside the broader Miasma supply-chain campaign, and it landed on PyPI with 37 malicious wheel artifacts spread across 19 packages.

The trick isn't novel so much as well-chosen. Each compromised release ships a *-setup.pth file. If you've never had to care about .pth files, congratulations on a happy life: they're path-configuration files Python's site module processes at interpreter startup, and lines starting with import get executed. Drop one in site-packages and you have persistence that fires the moment anything in that environment runs.

Think of it as the Python ecosystem's answer to an autorun.inf. Old primitive, new packaging.

The payload behavior is where Hades narrows its scope. Rather than the spray-and-pray credential vacuuming we've seen from earlier Shai-Hulud descendants, this variant goes after Bun — the JavaScript runtime and package manager that's been quietly eating into Node.js territory. The malicious wheels look for Bun-related credentials and config on the host, which suggests the operators are profiling polyglot dev environments where a Python install is the soft underbelly for stealing JavaScript-side secrets.

That's a meaningful tell. The Miasma family is no longer one blob of code looking for any token it can grab. It's splintering into ecosystem-specific modules, each tuned to a particular developer toolchain. We've seen the same evolutionary pressure on the npm side over the last year.

A few things worth flagging for defenders.

First, .pth execution is not a PyPI bug — it's documented Python behavior. Mitigations live at the environment level: ephemeral virtualenvs, locked dependency hashes via pip install --require-hashes, and CI runners that don't share site-packages with anything you care about.

Second, if your build pipeline has any reason to install a Python package and any reason to have Bun installed on the same image, treat that combination as a credential-exposure path until proven otherwise. Rotate any Bun auth tokens that lived on shared builder hosts in the affected window.

Third, the malicious wheels have been pulled, but the package names have not been publicly enumerated in the disclosure I've seen. Run an inventory pass against your lockfiles anyway. Any wheel with a .pth file that imports network code at install or import time deserves a second look, regardless of whether it's on a known-bad list.

The broader pattern matters more than this specific wave. Shai-Hulud started as a worm. Miasma turned it into a campaign. Hades is what happens when a campaign matures into a toolkit, with operators picking targets based on which developer ecosystem yields the best secrets per compromised box. Expect more variants. Expect them to be quieter.