Shai-Hulud’s PyPI Wave Turns Science Packages Into a Startup-Time Trap

The latest Shai-Hulud-linked package compromise did not wait for researchers to import a library before creating risk. It used the packaging layer itself as the trigger, turning a normal Python startup path into a possible bridge from a scientific workstation or CI runner to developer secrets.

A science-package compromise with developer-tool reach

Socket reported a coordinated PyPI compromise involving 37 malicious wheel artifacts across 19 packages, with several affected projects used in bioinformatics, spatial transcriptomics, genomic visualization, and FISH image-analysis workflows. Socket’s analysis named examples including dynamo-release, spateo-release, coolbox, ufish, and napari-ufish, while BleepingComputer separately covered the wave as a new PyPI branch of the broader Shai-Hulud activity. BleepingComputer

The important detail is not only the package count. Socket says the malicious wheels shipped a *-setup.pth file and an obfuscated JavaScript payload named _index.js, then attempted to download the Bun runtime from GitHub before running the payload. Socket technical breakdown

Why .pth files matter

Python’s site module processes path-configuration files during interpreter startup, and the Python documentation says lines in a .pth file that begin with import followed by whitespace are executed. Python site module documentation That means the next interpreter launch, test run, package-management command, notebook kernel, or CI job can become the moment when a malicious startup hook fires.

In this campaign, that startup edge mattered because the payload was built to reach beyond a single Python package. Socket’s deobfuscation found targeting for GitHub credentials, GitHub Actions secrets, package-publishing tokens for ecosystems including npm, PyPI, RubyGems and JFrog, cloud credentials for AWS, GCP and Azure, Kubernetes and Vault material, SSH keys, Docker configuration, shell histories, .env files, .npmrc, .pypirc, and Claude/MCP configuration files. Socket capability analysis

The pattern defenders should recognize

This wave fits the larger Shai-Hulud/Miasma operating model: compromise trusted package channels, execute before normal application review, harvest credentials from developer and CI environments, and use source-control or automation systems as the next pivot. Socket says this PyPI branch reused recognizable family tradecraft while adapting the trigger from npm-style install hooks to Python startup-time execution. Socket campaign analysis

Look for the startup chain, not just package names

Package blocklists are useful, but the stronger detection idea is behavioral: a wheel containing executable .pth content, a nearby _index.js, runtime download activity for Bun, and a process chain where Python launches Bun to execute JavaScript. Socket lists that combination as a high-confidence detection opportunity and warns that exact filenames or Bun versions can change. Socket detection guidance

Prioritize the secrets that let the attack spread

Organizations that installed an affected version should remove or pin away from the malicious release, rebuild affected environments where possible, and rotate credentials that were available to developer machines or CI jobs. Socket specifically recommends prioritizing GitHub tokens and deploy keys, package-publishing credentials, cloud and Kubernetes secrets, Vault material, SSH keys, Docker credentials, shell-history secrets, and developer-tool tokens. Socket response guidance

What teams should change after this wave

The practical lesson is that scientific and data-heavy Python environments deserve the same supply-chain controls as production services. Build systems should scan wheel contents before installation, alert on executable .pth hooks, restrict outbound network access from build runners, and keep package-publishing tokens out of day-to-day developer shells wherever possible.

For research groups, the cultural shift may be even more important: a package that powers notebooks, genomics pipelines, or visualization tooling can still be a route into cloud infrastructure and source-control systems if the same machine holds broad credentials. Treat package installation as code execution, rotate secrets after exposure, and make rebuildable environments the default response path rather than trying to disinfect a workstation in place.