Hades Buried a Bun Credential Worm Inside Six PyPI Bioinformatics Wheels in Under a Minute

A PyPI supply-chain crew tracked as TeamPCP spent a single morning on June 8, 2026 republishing six official bioinformatics packages with a credential worm hidden inside their compiled native extensions, and the entire reupload sequence wrapped in under sixty seconds. The affected projects were embiggen, ensmallen, gpsea, phenopacket-store-toolkit, ppkt2synergy, and pyphetools, all part of the wider Mini Shai-Hulud and Hades activity the same actor had been running across PyPI and npm since June 1, which Socket's research team named after tracking more than 473 malicious artifacts across the cluster. The Hades sub-wave matters most for blue teams because the payload was not the usual preinstall script anyone with a junior grep can find, since the attackers buried a JavaScript worm written for the Bun runtime inside the package's trojanized .abi3.so native extension, the compiled binary every Python developer trusts the maintainer to ship without reading. Detailed coverage of the cluster comes from Socket and Endor Labs, with corroborating reporting from SecurityWeek, BleepingComputer, and Tenable.

Initial access was the same well practiced move that has powered every Shai-Hulud descendant, theft of maintainer publish tokens through phishing and reused credentials, and once Hades had a token it pulled the legitimate wheel, tampered the compiled extension, and pushed a fresh version under the maintainer's identity. The wheel installed cleanly because the .abi3.so file looked like the native extension the Python interpreter expected, so import resolution loaded the binary like any other CPython ABI3 module. The novelty sits in what the binary did at load time, dropping and executing a JavaScript worm against the Bun runtime that the attacker staged on the host or fetched on first run, so the credential sweep ran in a runtime almost no defender expects to see inside a Python project. Tenable and Socket both noted that this is the first wave to hide the worm inside a compiled native extension instead of the usual setup.py or postinstall script, which means signature scanners trained on JavaScript or shell content found nothing on the file every defender is supposed to look at first. The CVE assigned to the bioinformatics cluster is CVE-2026-45321, and the broader Mini Shai-Hulud and Hades activity has been tracked across the @redhat-cloud-services namespace, TanStack, UiPath, DraftLab, and a growing set of MCP and AI developer tooling packages, as catalogued by SC World.

The detection and response gap

Every assumption defenders rely on for supply-chain hygiene gets stress tested by Hades, and most environments fail at least one of these checks:

• Native extension binaries are treated as trusted maintainer artifacts. The .abi3.so file in a Python wheel is a build output most security teams never reverse, so a worm living inside the compiled extension instead of a script does not show up in lockfile diffs, dependency audit output, or signature scanners tuned for JavaScript and shell content.
• The Bun runtime sidesteps Node and Python sandboxing assumptions. By targeting Bun the attacker runs JavaScript outside the Python interpreter and outside any Node process telemetry your stack already collects, so the worm executes in a runtime your EDR profile probably does not flag and your CI logs probably do not record.
• The publish window was sixty seconds. Six packages republished inside one minute means any organization that ran a pip install or a CI dependency resolution during that window had already executed the payload before the first advisory or PyPI yank could reach defenders.
• Maintainer identity still anchored trust. PyPI showed the same maintainer, the version bump looked routine, and Trusted Publishers and provenance attestation were not enforced on these projects, which left integrity checking to whoever happened to be reading release notes.

Mapping the behavior to MITRE ATT&CK

Translating Hades into a working ATT&CK kill chain gives the blue team something concrete to hunt against and validate:

• T1195.002 Compromise Software Supply Chain: malicious versions of the six bioinformatics packages republished through normal PyPI plumbing under the rightful maintainer accounts.
• T1078 Valid Accounts and T1528 Steal Application Access Token: theft of legitimate maintainer publish tokens used to push tampered builds under the rightful identity.
• T1059.007 JavaScript and T1059.006 Python: the loader sat inside a Python native extension and staged a Bun JavaScript runtime payload at import time, the unusual combination that broke many existing detections.
• T1027.009 Embedded Payloads: the credential worm carried inside the compiled .abi3.so artifact rather than the script files most scanners inspect first.
• T1552.001 Credentials In Files and T1555 Credentials from Password Stores: the worm harvested GitHub tokens, AWS and GCP and Azure credentials, SSH keys, and any .env values it could reach.
• T1071.001 Web Protocols and T1080 Taint Shared Content: stolen secrets exfiltrated over HTTPS, and the same publish tokens reused to seed the next wave.

Operationalizing a response

Any Python environment that resolved one of the six bioinformatics packages on June 8, 2026, even briefly inside a transient build, should be treated as a credential compromise until the cleanup below is complete, because the gap between import time and outbound beacon on Hades is measured in seconds:

1. Diff every requirements.txt, poetry.lock, pipfile.lock, conda environment file, and CI cache against the Socket and Endor Labs version lists for the six packages, and pin to the last clean release before the malicious version cut.
2. Rotate every secret reachable from the affected machines, including GitHub tokens, AWS and GCP and Azure credentials, SSH private keys, PyPI and npm publish tokens, Kubernetes kubeconfigs, HashiCorp Vault tokens, Docker registry credentials, and any .env values present on developer workstations or runners.
3. Hunt for Bun runtime processes spawned by Python interpreters anywhere in your CI fleet and developer endpoints, because that parent and child pairing is the local signal that Hades is on the box even when no signature scanner ever fires.
4. Review your own PyPI and npm publish history for unauthorized version bumps, because a developer who installed Hades with publish rights on internal packages may have already seeded the next wave on artifacts your team owns.
5. Enforce PyPI Trusted Publishers and provenance attestation on every internal package, refresh lockfiles against a clean mirror, and scope every maintainer token to a specific package set so a single phish cannot blast a whole namespace.

How BlueTeamAutomation closes the loop

Doing all of this by hand, after a tampered wheel is already in your lockfiles and a Bun process has touched your credential stores, is the slow path Hades was engineered to exploit. BlueTeamAutomation runs the full blue-team workflow against this class of PyPI native extension worm continuously, on hardware you control:

• BAS validation. BASzy emulates the Hades sequence end to end, a tampered .abi3.so import that stages a Bun runtime and beacons credentials over HTTPS, so you find out which controls actually fire while it is still a drill.
• EDR. On-device detection catches a Python interpreter spawning a Bun process that reads kubeconfig, .env, SSH keys, and cloud credential stores in rapid succession, the local signal that lights up even when the outbound traffic looks like ordinary developer telemetry.
• SIEM correlation. PyPI install events, endpoint and runner process telemetry, GitHub Actions audit logs, and cloud control plane reads collapse into one timeline, so a fresh bioinformatics wheel plus a Bun spawn plus a credential read plus an unexpected egress becomes one alert instead of four.
• SOAR response. Automated playbooks quarantine the workstation or runner, revoke and rotate exposed publish tokens and cloud credentials, force a lockfile refresh, and open the incident inside the minute that decides how far the worm reaches.
• Compliance evidence. Every validation run, detection, and response action is captured as audit-ready evidence for SOC 2, ISO 27001, and the incident reporting obligations your customers and regulators expect.

Hades is the same lesson Miasma already taught about npm, only with the worm hidden one layer deeper inside the build artifact your developers trust the maintainer to ship, and the same answer applies on either side of the language boundary. Continuous validation paired with local detection and automated response is what separates catching the next compiled supply-chain payload in a drill from explaining to your customers why a sixty-second publish window cost them their secrets.