'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud

Researchers from Socket detailed a Mini Shai-Hulud campaign that infected PyPI packages (37 wheels across 19 packages) to execute a Bun-based JavaScript credential stealer via Python .pth startup abuse; the worm self-propagates, steals developer/cloud/CI secrets during install, and uses Hades-themed exfiltration markers. PyPI quarantined affected releases; organizations are advised to audit environments, assume any install-time secrets may be compromised, and rotate credentials while implementing continuous monitoring of package installations and artifacts.