SlowMist: Shai-Hulud Hades New Variant Exploits PyPI, Utilizes Python-to-Bun Cross-Runtime Chain for Credential Theft

On June 12, cybersecurity firm SlowMist uncovered a new variant of the Shai-Hulud malware dubbed Hades that targets the Python Package Index (PyPI). The malicious package includes a .pth file which runs automatically when Python starts up. It first checks if Bun is installed on the target system; if not, it downloads the official Bun binary from GitHub Releases, then executes a multi-layer obfuscated JavaScript payload to steal credentials from GitHub, npm, AWS, and other cloud services. SlowMist states this Hades variant uses the same RSA public key and infrastructure as previous Shai-Hulud attacks, and features capabilities like encrypted data exfiltration, system persistence, CI/CD pipeline injection, and GitHub Actions injection.