Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer

These compromised releases included a *-setup.pth file designed to execute automatically upon installation. The malware's primary objective is to steal Bun JavaScript runtime credentials. This attack vector leverages a technique similar to the "Mini Shai-Hulud" campaign, which previously targeted developers by injecting malicious code into popular software libraries.

The Hades campaign specifically targets developers using the Bun runtime, indicating a growing sophistication in supply chain attacks that aim to compromise specific development environments and steal sensitive information. The discovery highlights ongoing vulnerabilities within open-source package repositories and the persistent threat of malicious actors exploiting them to distribute malware.