'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud

Researchers uncovered the 'Hades' supply-chain campaign that compromised 37 Python wheel distributions across 19 packages to exfiltrate developer credentials and self-propagate using stolen maintainer accounts; the campaign leverages obfuscation, delayed payload activation, and encrypted C2, and organizations are advised to pin dependencies, enable package integrity verification, and audit installs.