--- title: "New Shai-Hulud attack trojanizes 19 science-focused PyPI packages" url: https://daily.dev/posts/new-shai-hulud-attack-trojanizes-19-science-focused-pypi-packages-kbwsjoihp source_url: https://www.bleepingcomputer.com/news/security/new-shai-hulud-attack-trojanizes-19-science-focused-pypi-packages type: article source: "BleepingComputer" published: 2026-06-08T20:44:07.501Z updated: 2026-06-08T20:44:49.897Z tags: ["security", "cyber", "python", "malware"] reading_time: 3 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Shai-Hulud attack trojanizes 19 science-focused PyPI packages **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary A supply-chain attack dubbed 'Shai-Hulud' has compromised 19 PyPI packages — many popular bioinformatics tools like Dynamo, Spateo, and Napari-UFISH — across 37 malicious releases. The attack was discovered by Socket and works by injecting a malicious .pth file and obfuscated JavaScript payload into package wheels. Simply starting Python triggers the .pth file, which downloads the Bun JavaScript runtime from GitHub to execute the payload. The malware targets a wide range of developer secrets including GitHub tokens, cloud credentials (AWS, GCP, Azure), SSH keys, Docker credentials, and CI/CD secrets. Exfiltration uses auto-created GitHub repositories and a camouflaged HTTPS endpoint mimicking Anthropic's API. Persistence is achieved via systemd on Linux and LaunchAgents on macOS. This campaign is linked to a broader Shai-Hulud operation now tracking 453 malicious artifacts. Affected organizations are advised to rotate all secrets and restore from clean backups. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting](https://daily.dev/posts/shai-hulud-copycat-campaign-targets-python-developers-through-pypi-typosquatting-sx3wjf52s) · GitLab · 0 upvotes · 0 comments - [Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformati...](https://daily.dev/posts/mini-shai-hulud-miasma-and-hades-worms-target-bioinformati--ppodpf9q9) · Socket · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/new-shai-hulud-attack-trojanizes-19-science-focused-pypi-packages-kbwsjoihp)