StepSecurity Adds File Detection for Miasma and Hades on Developer Machines
Summary
StepSecurity announced Suspicious Files for Dev Machine Guard, which detects files linked to the Miasma and Hades supply-chain campaigns on enrolled developer machines. The article says the worms can execute on project open or package import.
Key points
- StepSecurity says Miasma and its PyPI branch, Hades, can execute through project files when a project is opened or a package is imported, not only during installation.
- StepSecurity reports that Miasma used a 157-byte binding.gyp file, dubbed Phantom Gyp, to trigger code execution during npm's native build step.
- The article says Hades embeds an import hook in __init__.py that downloads a Bun runtime and runs a JavaScript payload; it also says the campaigns seek package publishing tokens to spread.
- StepSecurity reports that Miasma compromised 57 npm packages across more than 286 malicious versions on June 3, 2026, and that Hades affected ensmallen and roughly two dozen related PyPI packages on June 8.
- The article says the campaigns also use editor and AI-tool configuration files, including VS Code folder-open tasks and Claude Code session hooks, to execute when projects or sessions start.
- StepSecurity's Suspicious Files feature is designed to detect campaign-associated files across enrolled developer machines using centrally maintained rules; its dashboard shows the matched file, device, rule, confidence, and SHA-256.
Article Details
- Event Type
- Active software supply-chain worm campaigns targeting npm and PyPI packages and developer machines.
- Impact
- The article reports that Miasma compromised 57 npm packages across more than 286 malicious versions on June 3, 2026, and that Hades compromised the PyPI package ensmallen and roughly two dozen related packages on June 8. It says the worms execute during package installation, import, or project opening; search for publishing tokens and republish infected packages; and that the campaign spread across 73 Microsoft Azure GitHub organization repositories in under two minutes, with more than 113 repositories infected overall. The article also reports that Hades can read secrets from process memory and downloads a Bun runtime.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes Hades's malicious import hook as obfuscated.T1059.006 · PythonThe article describes an obfuscated Python import hook embedded in a package's __init__.py that triggers execution.T1059.007 · JavaScriptThe article says Hades downloads a Bun runtime and runs a JavaScript payload.T1105 · Ingress Tool TransferThe article says Hades downloads a standalone Bun runtime to the developer machine.T1195.001 · Compromise Software Dependencies and Development ToolsThe article reports malicious npm and PyPI packages used to propagate the worms through software dependencies.
Malware
HadesThe Miasma worm and its PyPI branch, Hades, are spreading across the npm and PyPI ecosystems right now. They do not wait for a build step or a careless npm install. They run when a developer opens a project or imports aMiasmaThe Miasma worm and its PyPI branch, Hades, are spreading across the npm and PyPI ecosystems right now. They do not wait for a build step or a careless npm install. They run when a developer opens a project or imports a
Vendors
Products
Bunin a package's __init__.py. The moment a developer imports the package, the hook downloads a standalone Bun runtime and runs a JavaScript payload. A developer does not have to run anything malicious on purpose.Cursor.cursor/rules/setup.mdcDev Machine Guardmost teams rely on, EDR, registry gateways, and SCA scanners, were not built to catch this. Dev Machine Guard's new Suspicious Files feature is, detecting the files these worms drop on developer machines withnpmThe Miasma worm and its PyPI branch, Hades, are spreading across the npm and PyPI ecosystems right now. They do not wait for a build step or a careless npm install. They run when a developer opens a project or imports aPyPIThe Miasma worm and its PyPI branch, Hades, are spreading across the npm and PyPI ecosystems right now. They do not wait for a build step or a careless npm install. They run when a developer opens a project or imports a