#5
BleepingComputer
general
June 08, 2026 at 20:41 UTC
New Shai-Hulud attack trojanizes 19 science-focused PyPI packages
By Bill Toulas
AI Summary
A new supply chain attack dubbed Shai-Hulud 'Hades' campaign compromised 19 science-focused PyPI packages across 37 wheels, collectively downloaded hundreds of thousands of times, delivering malware designed to steal developer secrets and credentials. The packages were trojanized to run a self-replicating stealer and included a leaked bot token embedded within the malware itself. This is the second iteration of the Shai-Hulud campaign and signals continued evolution of PyPI-targeting threat actors.
Relevance score: 85.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →