A new wave of the Shai-Hulud PyPI attack is accelerating concerns around open-source supply chain security. Researchers have uncovered 23 additional malicious PyPI packages, expanding an already large-scale campaign targeting developers—particularly those building AI and Model Context Protocol (MCP) integrations.

The campaign, tracked by Socket Threat Research, now spans 471 malicious artifacts across npm and PyPI, highlighting a rapidly evolving threat landscape where attackers weaponize trusted development ecosystems to infiltrate software pipelines.

Key Details

The latest wave builds on earlier activity associated with the Mini Shai-Hulud, Miasma, and Hades threat clusters, which collectively focus on credential theft and developer environment compromise.

Current campaign scale:

411 npm artifacts across 106 packages
60 PyPI artifacts across 37 packages
23 newly identified PyPI malicious versions

The attack specifically targets:

AI and MCP developers (e.g., langchain-core-mcp, openai-mcp)
Bioinformatics tooling used in research environments
Typosquatted packages mimicking popular libraries like requests and Flask

This strategic targeting demonstrates a clear shift toward high-value development ecosystems, including AI workflows and research pipelines.

Technical Analysis

Three Advanced Delivery Mechanisms

The Shai-Hulud campaign stands out for its rapid evolution in delivery techniques, now using three distinct execution paths:

1. .pth Startup Hook Execution

Malicious Python wheels include a *-setup.pth file that executes automatically when Python starts.

Downloads the Bun JavaScript runtime
Executes an obfuscated _index.js payload
Operates silently at runtime initialization

2. Native Extension Injection

Attackers embed malicious logic inside compiled .abi3.so extensions.

Python source appears benign
Malicious code executes via dlopen() during module import
Bypasses static code review and SCA tools

3. Split-Staging Loader Variant

A sophisticated approach seen in langchain-core-mcp:

Installs a loader via .pth
Searches sys.path for payloads
Separates loader and payload to evade detection

This modular architecture makes traditional signature-based detection less effective.

Obfuscation and Anti-Analysis Techniques

The _index.js payload includes a novel LLM evasion technique:

A large fake “system instruction” block embedded in comments
Designed to confuse AI-assisted security tools
Causes misclassification or analysis failure

The actual malware is hidden:

Encoded with ROT-style cipher
Wrapped in try { eval(...) }
Executed dynamically at runtime

Despite this, traditional security methods like YARA rules, entropy checks, and AST parsing can still detect the payload.

Hades Stealer Payload

Once executed, the malware deploys a Hades-family stealer that aggressively exfiltrates sensitive information.

Targeted data includes:

Developer credentials: GitHub, npm, PyPI, RubyGems, JFrog
Cloud secrets: AWS, Azure, GCP tokens, Kubernetes configs
Access keys: SSH keys, Docker configs, .env files
Operational artifacts: shell history, CI/CD credentials
AI tooling configs and model integration tokens

This aligns with credential harvesting and exfiltration tactics (MITRE ATT&CK T1555, T1552).

Impact and Risks

Who Is Affected

AI and MCP developers using experimental toolchains
Data scientists and bioinformatics researchers
DevOps engineers and CI/CD pipelines
Organizations relying on PyPI dependencies

Real-World Implications

A single compromised dependency can result in:

Full developer workstation compromise
Cloud account takeover
Supply chain pivot into production environments
Data exfiltration from CI/CD pipelines

Because these packages are integrated during development, attackers gain early access into software lifecycles, making detection significantly harder.

Expert Recommendations

1. Block Known Malicious Packages

Immediately remove or block the following compromised artifacts:

embiggen (0.11.97), ensmallen (0.8.101), gpsea (0.9.14)
langchain-core-mcp (1.4.2, 1.4.3), openai-mcp (2.41.1, 2.41.2)
instructor-mcp, tiktoken-mcp, ray-mcp-server
rsquests, rlask, tlask (typosquats)

2. Enforce Dependency Security

Use allowlists and package integrity verification
Implement hash pinning and dependency locking
Deploy software composition analysis (SCA) tools

3. Harden Developer Environments

Restrict execution of .pth files and dynamic loaders
Monitor unusual Python startup behavior
Use sandboxing for untrusted code execution

4. Protect Credentials

Rotate exposed tokens immediately
Enforce multi-factor authentication (MFA)
Avoid storing secrets in plaintext .env files

5. Monitor for Indicators of Compromise

Unexpected outbound connections
Access to cloud metadata services
Suspicious package installation logs

6. Secure CI/CD Pipelines

Isolate build environments
Limit permissions of service accounts
Scan dependencies before deployment

Industry Context

The Shai-Hulud campaign reflects a broader trend: supply chain attacks are becoming more targeted, stealthy, and developer-focused.

Recent attacks increasingly exploit:

Open-source ecosystems (PyPI, npm)
AI development stacks and SDKs
Trust relationships in CI/CD pipelines

The inclusion of AI-targeted packages marks a notable shift, suggesting attackers are actively pursuing access to next-generation development environments.

Additionally, the use of LLM-based evasion techniques signals a new phase where threat actors adapt to defensive technologies, including AI-powered security tools.

Conclusion

The latest expansion of the Shai-Hulud campaign underscores a critical reality: developers are now prime targets in modern cyberattacks.

With 23 new malicious PyPI packages and increasingly advanced evasion techniques, organizations must rethink how they secure open-source dependencies. Proactive monitoring, strict dependency controls, and strong credential hygiene are no longer optional—they are essential to protecting the software supply chain.

FAQ SECTION

What is the Shai-Hulud PyPI attack?

It is a large-scale supply chain attack involving malicious Python packages designed to steal credentials and compromise developer environments.

How many packages are affected?

The campaign now includes 60 PyPI artifacts across 37 packages, with 23 newly discovered malicious versions.

What is the main goal of the attack?

To steal developer credentials, cloud secrets, and access tokens from local systems and CI/CD pipelines.

Why are MCP and AI developers targeted?

These environments often hold sensitive API keys, model access tokens, and cloud credentials, making them high-value targets.

How can developers stay protected?

Use trusted dependencies, enable MFA, scan packages before installation, and monitor for suspicious activity.