--- title: Shai-Hulud hits PyPI, Django patches five CVEs | daily.dev description: A Python-focused security and ecosystem roundup covering several major developments. The Shai-Hulud 'Hades' supply chain attack planted malicious code in 37... canonical: https://daily.dev/posts/shai-hulud-hits-pypi-django-patches-five-cves-idgzt6kaw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Shai-Hulud hits PyPI, Django patches five CVEs | daily.dev og:description: A Python-focused security and ecosystem roundup covering several major developments. The Shai-Hulud 'Hades' supply chain attack planted malicious code in 37... og:url: https://daily.dev/posts/shai-hulud-hits-pypi-django-patches-five-cves-idgzt6kaw og:image: https://api.daily.dev/og/posts/IDgzT6kAW.png og:image:alt: Shai-Hulud hits PyPI, Django patches five CVEs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Shai-Hulud hits PyPI, Django patches five CVEs **[Python Digest](https://daily.dev/sources/python_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary A Python-focused security and ecosystem roundup covering several major developments. The Shai-Hulud 'Hades' supply chain attack planted malicious code in 37 wheel artifacts across 19 PyPI packages, using a .pth startup hook to silently exfiltrate cloud credentials, SSH keys, and tokens without requiring any import. Django released versions 6.0.6 and 5.2.15 patching five CVEs including a STARTTLS downgrade vulnerability and cache poisoning issues. Astral's tooling continues rapid growth with ruff at 243M installs/month and uv at 337M total, while the Python Steering Council gave the experimental CPython JIT six months to produce an accepted PEP or face removal from main. Additional items include a silently patched Hugging Face Transformers RCE, Python 3.15.0 beta 2 with JIT speedups, Meta's Pyrefly 1.0 type checker, and the end-of-life of the Bleach HTML sanitizer. ## Content **TLDR:** A supply chain attack called Shai-Hulud 'Hades' planted malicious code in 37 wheel artifacts across 19 PyPI packages, using a .pth startup hook to run before any import and exfiltrate cloud credentials and SSH keys. Django released 6.0.6 and 5.2.15 fixing five CVEs, including a STARTTLS downgrade and cache poisoning issues worth patching immediately. Astral's tooling numbers are striking: ruff at 243M installs/month, uv at 337M total, and ty up 300% since February. The Python Steering Council gave the experimental JIT a six-month deadline to produce an accepted PEP or get removed from main. --- ## Shai-Hulud 'Hades' branch: 37 malicious wheels across 19 PyPI packages, no import required Unlike typical malicious packages that need an explicit import to trigger, Hades uses a Python .pth startup hook that runs automatically at interpreter startup after a single pip install. The payload downloads the Bun runtime, then executes an obfuscated JavaScript stealer targeting GitHub tokens, PyPI/npm credentials, AWS/GCP/Azure/Kubernetes secrets, SSH keys, and AI tool configs — exfiltrating everything to attacker-controlled public GitHub repos. Affected packages include legitimate research tools like dynamo-release, spateo-release, coolbox, and ufish. If you've installed any of these recently, rotate secrets in the order the post recommends and check for unexpected .pth entries in your site-packages. [Read more](https://app.daily.dev/posts/coqLi3SH8) ## Django 6.0.6 and 5.2.15 fix five CVEs including STARTTLS downgrade and cache poisoning The five CVEs cover a signed cookie salt namespace collision, silent STARTTLS failure that can leave email unencrypted in transit, two separate cache poisoning issues via case-sensitive Cache-Control and whitespace-padded Vary headers, and a missing Vary: Authorization header on authenticated responses. None are rated critical, but the STARTTLS downgrade (CVE-2026-7666) and the caching issues are worth treating as urgent if you're running any public-facing Django app. Upgrade to 5.2.15 or 6.0.6 now. [Read more](https://app.daily.dev/feed-by-ids?id=bbbv6mx35&id=0r7W6h8w1) ## Astral tooling growth: ruff at 243M/month, uv at 337M total, ty up 300% Since February, ruff doubled to 243M PyPI installs per month, uv doubled to 165M on PyPI plus 172M from Astral's own CDN for 337M total, and ty tripled to 30M installs per month. The numbers suggest ty is moving from early adopter to mainstream faster than most expected. Astral also added a two-person manual approval requirement for all releases of uv, ty, and ruff — a meaningful supply chain improvement given the install volumes involved. [Read more](https://app.daily.dev/feed-by-ids?id=IKWGkDF5j&id=OPs0J6UBs&id=iJNkTlBZJ) ## Python Steering Council gives the CPython JIT six months to produce an accepted PEP or be removed The Council acknowledged the technical work but is requiring a Standards Track PEP before any new JIT development lands on main. The PEP must address long-term maintenance, compatibility with free-threading, profilers and debuggers, measurable success metrics, and the relationship to third-party JIT compilers. If no PEP is accepted within six months, the JIT code gets pulled from the main branch entirely. This is a real deadline, not a soft suggestion — worth watching if you're building tooling that depends on CPython internals. [Read more](https://app.daily.dev/posts/wEOvMzLZi) --- ## Also notable - **Hugging Face Transformers RCE (CVE-2026-4372) silently patched in 5.3.0, ~7-8M vulnerable downloads weekly:** An unfiltered setattr on config.json keys lets attackers execute arbitrary code by embedding a malicious _attn_implementation_internal field in a model config, bypassing trust_remote_code=false — the fix shipped in 5.3.0 on March 3 but roughly a quarter of weekly downloads are still on vulnerable versions. [Read more](https://app.daily.dev/posts/UYsdnnBZ0) - **Python 3.15.0 beta 2 released with JIT showing 8-9% speedup on x86-64:** Beta 2 is the second of four planned betas before final release; the JIT shows 8-9% improvement on x86-64 Linux and 12-13% on AArch64 macOS, alongside explicit lazy imports (PEP 810), a new frozendict built-in, and a sentinel built-in — not for production, next beta scheduled June 23. [Read more](https://app.daily.dev/posts/bYIsQ3XCX) - **Meta releases Pyrefly 1.0, a Rust-powered Python type checker with Django and Pydantic built-in:** Pyrefly 1.0 offers zero-dependency installation, automatic migration from Mypy/Pyright configs, inlay type hints in VS Code, and experimental PyTorch tensor shape checking — it scores higher on typing spec conformance than Mypy but below Pyright, and is MIT-licensed. [Read more](https://app.daily.dev/posts/K4vukcQpr) - **Bleach 6.4.0 is the final release after 16 years; migrate to nh3 or justhtml:** The maintainer is ending the project because the underlying html5lib dependency is unmaintained and solo maintenance is no longer sustainable after 64 releases and ~960 commits; users should migrate to justhtml (which provides a migration guide) or the browser Sanitizer API. [Read more](https://app.daily.dev/posts/5HXndQvmA) - **Diffrax (JAX ODE solver) delivered a 7x speedup over SciPy solve_ivp with exact autodiff gradients:** Replacing SciPy's solve_ivp with Diffrax cut a cosmological forward call from 404 μs to 59 μs, eliminated finite-difference gradient approximations, and enabled batched solves via vmap — the post includes working code for ΛCDM parameter inference and three practical caveats for production use. [Read more](https://app.daily.dev/posts/Ejsgq5FXn) ## Similar posts on daily.dev - [New Shai-Hulud attack trojanizes 19 science-focused PyPI packages](https://daily.dev/posts/new-shai-hulud-attack-trojanizes-19-science-focused-pypi-packages-kbwsjoihp) · BleepingComputer · 0 upvotes · 0 comments - [Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting](https://daily.dev/posts/shai-hulud-copycat-campaign-targets-python-developers-through-pypi-typosquatting-sx3wjf52s) · GitLab · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#django](https://daily.dev/tags/django) [View this post on daily.dev](https://daily.dev/posts/shai-hulud-hits-pypi-django-patches-five-cves-idgzt6kaw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/shai-hulud-hits-pypi-django-patches-five-cves-idgzt6kaw","headline":"Shai-Hulud hits PyPI, Django patches five CVEs","text":"A Python-focused security and ecosystem roundup covering several major developments. The Shai-Hulud 'Hades' supply chain attack planted malicious code in 37 wheel artifacts across 19 PyPI packages, using a .pth startup hook to silently exfiltrate cloud credentials, SSH keys, and tokens without requiring any import. Django released versions 6.0.6 and 5.2.15 patching five CVEs including a STARTTLS downgrade vulnerability and cache poisoning issues. Astral's tooling continues rapid growth with ruff at 243M installs/month and uv at 337M total, while the Python Steering Council gave the experimental CPython JIT six months to produce an accepted PEP or face removal from main. Additional items include a silently patched Hugging Face Transformers RCE, Python 3.15.0 beta 2 with JIT speedups, Meta's Pyrefly 1.0 type checker, and the end-of-life of the Bleach HTML sanitizer.","url":"https://daily.dev/posts/shai-hulud-hits-pypi-django-patches-five-cves-idgzt6kaw","datePublished":"2026-06-08T04:20:57.151Z","dateModified":"2026-06-08T04:21:17.032Z","author":{"@type":"Organization","name":"Python Digest","logo":"https://media.daily.dev/image/upload/s--_8Rk7XLS--/f_auto,q_auto/v1776326905/logos/python_digest","url":"https://daily.dev/sources/python_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/python_digest","name":"Python Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Python Digest","item":"https://daily.dev/sources/python_digest"},{"@type":"ListItem","position":3,"name":"Shai-Hulud hits PyPI, Django patches five CVEs"}]} ```