GitLab's Vulnerability Research team discovered a coordinated PyPI supply chain attack deploying a copycat of the Shai-Hulud worm. Five malicious packages were identified: four typosquats impersonating Flask, Requests, and NumPy (rlask, tlask, rsquests, nhmpy), plus a weaponized legitimate project (mflux-streamlit). The attack exploits Python's .pth file mechanism to execute code at install time without any import required, then downloads the Bun JavaScript runtime to run a 5 MB obfuscated credential-stealing payload. The worm targets CI/CD credentials across GitHub, AWS, Azure, GCP, HashiCorp Vault, and Kubernetes, and self-propagates by injecting malicious files into accessible GitHub repositories and poisoning AI code assistant instructions. The campaign is a copycat of the original npm-based Shai-Hulud worm after TeamPCP open-sourced it in May 2026. All packages were reported to PyPI and advisories (GMS-2026-572 through GMS-2026-576) have been filed.
