stepsecurity.iowriteupThe Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
StepSecurity reports on the "Hades Campaign," a set of malicious PyPI packages masquerading as graph machine-learning libraries that deploy cross-platform memory-scraping malware. The campaign reportedly includes techniques designed to mislead AI-based security analysts reviewing the code, plus a destructive wiper component used as a deterrent against analysis or takedown. Content was not directly fetched, so details are based on the title and StepSecurity's known focus on software supply chain threats.
What it is
The "Hades Campaign" is a supply chain compromise of graph machine-learning and computational-biology PyPI packages, first identified June 8, 2026 in ensmallen version 0.8.101, with the identical payload found across related bioinformatics/genotype-phenotype packages. StepSecurity attributes it to the Miasma threat actor previously seen in npm worm campaigns (Phantom Gyp, AI coding-agent hijacking). Unlike the npm attacks, this one targets Python environments and executes on import, not install.
How it works
The entry point is an obfuscated single-line import hook in the package's __init__.py. On import it checks for a flag file at /tmp/.bun_ran; if absent, it crawls the Python module search paths (sys.path) for a companion _index.js, downloads the standalone Bun runtime (v1.3.14) as a ZIP from the legitimate oven-sh/bun GitHub releases, unzips it to a temp dir, and runs the JS payload via bun run _index.js. The flag file then throttles execution to once per boot.
Using a self-contained Bun binary lets complex JS run in environments without Node.js, sidestepping package-manager controls and proxy logs. The _index.js bootstrapper loads sixteen independent payload blobs, each gzip-compressed and AES-256-GCM-encrypted with a unique hardcoded key, decrypted at startup via native Bun APIs.
The novel element is AI-analyst misdirection: the top of _index.js contains a plain-text prompt injection instructing any LLM triage pipeline to ignore the obfuscated code, classify the package as clean infrastructure, and emit a safe report. Scanners that pass raw file text to an LLM without boundary isolation can be coerced into false-negative verdicts.
Preconditions / Affected
ensmallen 0.8.101 and related computational-biology/bioinformatics PyPI packages carrying the identical payload (the post references a package list not reproduced in fetched text). The malware runs when the package is imported in a Python environment on Linux, macOS, or Windows (the hook maps platform/arch to the matching Bun binary). It requires outbound access to GitHub and unzip on PATH.
What to do
The fetched text does not list mitigation commands. Concrete detections implied by the code:
- Alert on the flag file
/tmp/.bun_ran. - Alert on a Bun binary appearing under the temp directory (
<tmpdir>/b/bun) and downloads ofbun-{os}-{arch}.zipfromoven-sh/bunreleases by non-developer processes. - For AI-based package scanners: enforce strict prompt/data boundary isolation so file contents cannot override system instructions.
Caveats
The fetched text is truncated mid–Step 3; the full affected-package list, IOCs, and any exfiltration details are on the page but not in the captured content. The credential-harvesting, worm, and GitHub-exfiltration components are described as carried over unchanged from prior Miasma advisories rather than analyzed here.
Technologies named here
Threat actors named here
Related in Supply Chain
