{
  "name": "Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels",
  "slug": "mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious-pypi-wheels",
  "description": "A sophisticated supply chain attack campaign has expanded to 471 affected artifacts across npm and PyPI, targeting developers through malicious packages. The campaign uses three distinct delivery methods: executable .pth startup hooks, trojanized native .abi3.so extensions that execute at import time, and a split loader-payload architecture that searches Python's sys.path. Twenty-three newly identified PyPI packages masquerade as bioinformatics tools, AI frameworks, and popular libraries like requests and Flask. The attack deploys heavily obfuscated JavaScript stealers via Bun runtime, harvesting high-value credentials including GitHub tokens, npm registry access, cloud credentials, SSH keys, and CI/CD secrets. The malware employs anti-analysis techniques with fake LLM prompt-injection headers designed to disrupt AI-assisted security scanners, while targeting developer workstations and automated build environments.",
  "published": "2026-06-08T19:36:05.161000+00:00",
  "created_at": "2026-06-09T08:57:28.165000+00:00",
  "modified_at": "2026-06-09T06:57:28+00:00",
  "created_at_opencti": "2026-06-09T08:57:28.165000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "bioinformatics",
    "bun runtime",
    "ci/cd compromise",
    "credential theft",
    "hades",
    "javascript stealer",
    "mcp developers",
    "miasma",
    "mini shai-hulud",
    "native extensions",
    "pypi",
    "supply chain attack",
    "typosquatting"
  ],
  "tags": [
    "2026-06-08",
    "bioinformatics",
    "bun runtime",
    "ci/cd compromise",
    "credential-theft",
    "hades",
    "javascript stealer",
    "mcp developers",
    "miasma",
    "mini shai hulud",
    "native extensions",
    "pypi",
    "supply chain attack",
    "typosquatting"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "d4004ffb-b0ab-4bd0-9029-0708ad27720f",
        "name": "6506d31707a39949f89534bf9705bcf889f1ecae3dbc6f4ff88d67a8be3d01b2"
      },
      {
        "id": "9c28e764-1c02-474a-8a75-0c9bb86aa804",
        "name": "6d332f814f15f19758d65026bbfd0a8c49671b319ec77b8fa1b27fc48afff7d9"
      }
    ],
    "attack_patterns": [
      {
        "id": "e73b317e-ea92-49b4-a45d-051f7279aced",
        "name": "T1213"
      },
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "7671fe3e-6a85-463e-928d-16117d2f4f9b",
        "name": "T1059.006"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "e615d5ec-8d67-4048-b21d-a5fb09925bb9",
        "name": "T1552.001"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "9f21708c-24b6-46b5-bf7e-522256e8470c",
        "name": "T1552.004"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "99571c5a-1615-4466-ab0e-f4d9e9219640",
        "name": "T1552.006"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "1d0d9e67-eb8a-439c-a2c7-cab311bb25c4",
        "name": "T1195.002"
      },
      {
        "id": "a1de6d30-7fd6-4352-8f6c-d9904347f33f",
        "name": "T1039"
      },
      {
        "id": "4b9c2b12-37c3-4b52-a1fb-fcd8c20df2dc",
        "name": "T1574.006"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      }
    ],
    "malware": [
      {
        "id": "7f348e4a-a1c1-4851-be94-d8dbf0f08496",
        "name": "Mini Shai-Hulud",
        "slug": "mini-shai-hulud"
      },
      {
        "id": "c97eecb2-46dd-4e3b-8b82-906269d7cb83",
        "name": "Hades",
        "slug": "hades"
      },
      {
        "id": "2f504a89-03b5-446f-9820-2df5e962a0d1",
        "name": "Miasma",
        "slug": "miasma"
      }
    ],
    "observables": [
      {
        "id": "",
        "name": "6506d31707a39949f89534bf9705bcf889f1ecae3dbc6f4ff88d67a8be3d01b2"
      },
      {
        "id": "",
        "name": "6d332f814f15f19758d65026bbfd0a8c49671b319ec77b8fa1b27fc48afff7d9"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Technology"
      }
    ]
  },
  "external_refs": [
    {
      "id": "3896e8fa-44ff-4f5a-8d1f-a7ae0b219622",
      "standard_id": "external-reference--0937c00f-7894-59b8-bcce-0182d661a999",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a2719a5f6621cb5014a256d",
      "hash": null,
      "external_id": "6a2719a5f6621cb5014a256d",
      "created": "2026-06-09T08:57:26.831Z",
      "modified": "2026-06-09T08:57:26.831Z",
      "createdById": null
    },
    {
      "id": "fda979a0-597a-4e52-a5ec-f9547781a9b1",
      "standard_id": "external-reference--20b142c4-5a6e-5e4e-9c82-bc14dc90c896",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious",
      "hash": null,
      "external_id": null,
      "created": "2026-06-09T08:57:26.860Z",
      "modified": "2026-06-09T08:57:26.860Z",
      "createdById": null
    }
  ]
}