cyber.hendryadrian.com
Threat Research · stepsecurity.io

Step Security Details Hades Campaign Targeting PyPI Packages and CI Secrets

· Original article ↗

Summary

Step Security reports malicious PyPI packages in the Hades campaign. Their import-time Bun payload scrapes CI runner memory, steals secrets, spreads via SSH and publishing credentials, abuses GitHub Actions, and adds a token-revocation-triggered wiper.

Key points

  • Step Security identifies malicious versions of 29 PyPI packages, including ensmallen 0.8.101, and describes the campaign as a Miasma evolution.
  • An obfuscated __init__.py import hook downloads Bun v1.3.14 and runs _index.js on package import; a flag file limits execution to once.
  • The bundle includes a prompt injection intended to mislead LLM-based package analysis and loads 16 encrypted modules for different operating systems and contexts.
  • The payload reads Runner.Worker memory on Linux, macOS, and Windows to collect plaintext secrets, according to Step Security.
  • GitHub-based C2 uses commit-search markers for token harvesting and signed JavaScript or Python commands; stolen secrets are encrypted and pushed to public repositories.
  • Reported propagation methods include SSH/SCP, abuse of GitHub Actions OIDC publishing credentials with Sigstore/SLSA provenance, workflow injection to extract repository secrets, and IDE or AI-assistant configuration backdoors.
  • A persistent token monitor reportedly triggers a wiper that removes home and Documents directories if the stolen token is revoked; the script sets a 72-hour lifetime.

Article Details

Attack Vectors
  • Compromised Python packages execute an obfuscated import hook that downloads a Bun runtime into a temporary directory and runs the bundled JavaScript payload.
  • The payload reads GitHub Actions Runner.Worker process memory on Linux, macOS, and Windows to extract plaintext secrets and tokens.
  • The malware uses GitHub commits and repositories for token retrieval, command delivery, and exfiltration of stolen credentials.
  • It searches SSH configuration and known-host files, then uses SSH and SCP to stage and run the payload on reachable developer systems.
  • It abuses GitHub Actions OIDC credentials to obtain package-publishing tokens, create signed provenance, and publish packages containing the malicious hook and payload.
  • It injects workflows and IDE or AI-assistant configuration files to extract repository secrets and trigger execution in developer workspaces.
Defensive Notes
  • The article says runner monitoring can detect process execution and memory access, then terminate the process before the memory read completes.
  • Search repositories, pull requests, and developer devices for the affected package names and versions to assess exposure.
  • The described token-monitor service can trigger file deletion when a stolen token returns a 4xx response, so account for the reported wiper behavior during response.

MITRE ATT&CK

T1003.007 · Proc FilesystemOn Linux, the malware walks /proc/{pid}/maps and reads /proc/{pid}/mem to recover plaintext secrets from Runner.Worker.T1021.004 · SSHThe malware connects to hosts found in SSH configuration and known-host files to stage and execute the payload.T1027.013 · Encrypted/Encoded FileThe JavaScript bootstrapper decrypts AES-256-GCM-encrypted, gzip-compressed payload blobs before executing their modules.T1059.001 · PowerShellA PowerShell script runs on Windows and uses compiled C# code to read the target process memory.T1059.004 · Unix ShellA staged Bash loader runs on remote hosts, and a Bash monitor invokes the described destructive deletion commands.T1059.006 · PythonA Python import hook launches the payload; Python scripts also implement the polling dropper and macOS memory scraper.T1059.007 · JavaScriptThe downloaded Bun runtime executes the JavaScript payload, which also uses eval() to run verified JavaScript updates.T1102.002 · Bidirectional CommunicationThe malware polls GitHub commit search for commands and updates, and uses GitHub repositories and commits for its C2 channels.T1105 · Ingress Tool TransferThe import hook downloads a platform-specific Bun runtime, and the Python C2 daemon downloads scripts from URLs supplied in commits.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign distributes malicious code through compromised Python packages and describes republishing tampered packages using stolen or obtained publishing credentials.T1485 · Data DestructionIf the monitored stolen token is revoked, the wiper command deletes the user's home directory and Documents directory.T1528 · Steal Application Access TokenThe malware harvests GitHub personal access tokens from runner memory and uses them in subsequent operations.T1543.001 · Launch AgentOn macOS, the malware installs LaunchAgents for C2 polling and token monitoring.T1543.002 · Systemd ServiceOn Linux, the malware installs user-level systemd services for C2 polling and token monitoring.T1567.001 · Exfiltration to Code RepositoryStolen credentials and encrypted secrets are pushed to public GitHub repositories controlled by the attacker.T1570 · Lateral Tool TransferIt transfers the loader and JavaScript payload to remote hosts using SCP.

Threat Actors

MiasmaStep Security identifies the Hades Campaign as the latest evolution of Miasma's activity, including credential harvesting, GitHub-based C2 and exfiltration, lateral spread, and package supply-chain compromise.

Vendors

GitHubin our prior advisory posts. The core credential harvesting methods, self-replicating worm logic, and GitHub-based exfiltration are highly aligned with what was described in our previous posts:

Products

Bunmalicious payload. This operation, which we are tracking as the Hades Campaign, uses a self-contained Bun executable to execute a multi-layer payload silently on package import.GitHub ActionsA key capability of the Miasma actor is reading the process memory of the GitHub Actions runner (the Runner.Worker process) to extract secrets. In earlier campaigns, this was limited to Linux systems usingnpmMiasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp, where we detailed the multi-cloud credential sweep and self-spreading mechanics.PyPIOn June 8, 2026, version 0.8.101 of the popular graph machine learning package ensmallen on PyPI was identified as containing a highly sophisticated supply chain compromise. Concurrently, a series of related packages in

Industries

bioinformaticssupply chain compromise. Concurrently, a series of related packages in the computational biology, bioinformatics, and genotype-phenotype analysis ecosystem were also found to carry the identical malicious payload.Computational biologya highly sophisticated supply chain compromise. Concurrently, a series of related packages in the computational biology, bioinformatics, and genotype-phenotype analysis ecosystem were also found to carry the identicalGenotype-phenotype analysisConcurrently, a series of related packages in the computational biology, bioinformatics, and genotype-phenotype analysis ecosystem were also found to carry the identical malicious payload. This operation, which we

Related Articles