The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
Excerpt
Deterrent - StepSecurity
Summary
On June 8, 2026, version 0.8.101 of the popular graph machine learning package ensmallen on PyPI was identified as containing a highly sophisticated supply chain compromise. Concurrently, a series of related packages in the computational biology, bioinformatics, and genotype-phenotype analysis ecosystem were also found to carry the identical malicious payload. This operation, which we are tracking as the Hades Campaign, uses a self-contained Bun executable to execute a multi-layer payload silently on package import.
Affected Versions
The compromised packages identified in this campaign are listed…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by StepSecurity on stepsecurity.io.
More from StepSecurity1
- Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access TrojanStepSecurity · Added 31 Jul
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Attackers Target Agents via The Skill Supply Chainzenity.io · Published 6 Aug
