<p><strong>TLDR:</strong> The Shai-Hulud supply chain campaign has expanded significantly since last week, now tracking 471 malicious artifacts across PyPI and npm, with new waves hitting bioinformatics, graph ML, and MCP/AI developer packages. A separate but related Hades Campaign variant adds memory scraping, LLM-based analyzer evasion, and a wiper deterrent that destroys your home directory if you revoke the stolen GitHub token. Astral shipped uv audit and experimental malware detection to help defend against exactly this class of attack. On the ecosystem side, Django’s Software Foundation raised its 2026 fundraising target from $300K to $500K, and Python 3.14.6 and 3.13.14 are out as maintenance releases.</p>
<hr>
<h2>Shai-Hulud campaign reaches 471 artifacts, adds native extension and MCP package vectors</h2>
<p>Three new delivery mechanisms are now confirmed beyond the original .pth hook: trojanized native .abi3.so extensions that execute at import time, a langchain-core-mcp loader variant that searches sys.path for a separately staged _index.js payload, and the original .pth startup hook. The campaign now targets MCP and AI developer packages directly alongside bioinformatics tools like embiggen, ensmallen, and gpsea. The JavaScript stealer payload includes a fake prompt-injection header designed to fool LLM-based code analysis tools into generating false-negative reports — so automated scanning is not a reliable safety net here. Audit your Python environments for executable .pth files and unexpected .abi3.so extensions, and rotate any credentials that may have touched affected environments. <a href="https://app.daily.dev/feed-by-ids?id=PpODpF9Q9&amp;id=vV9yPkqgB&amp;id=KBwSjOIHP&amp;id=NVzcFrIXe&amp;id=rhP4RXaD7&amp;id=sX3Wjf52s" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Hades Campaign adds memory scraping, wiper deterrent, and LLM analyzer evasion</h2>
<p>The Hades variant targeting graph ML packages (ensmallen v0.8.101 and others) goes further than credential theft. It includes cross-platform memory scrapers for Linux, macOS, and Windows, three GitHub-based C2 channels using magic keywords in commit messages, and AES-256-GCM plus RSA-2048 encrypted exfiltration. The wiper deterrent is the part worth paying attention to: if the stolen GitHub token is revoked, the malware destroys the victim’s home directory — a deliberate mechanism to discourage immediate credential rotation. The adversarial prompt injection at the top of the payload is also a first for this campaign, specifically targeting LLM-based security analyzers. Immediate actions: remove affected package versions, rotate all credentials, and hunt for systemd services or LaunchAgents added for persistence. <a href="https://app.daily.dev/feed-by-ids?id=rhP4RXaD7&amp;id=PBX2B1Ksk&amp;id=vV9yPkqgB" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>uv audit and experimental malware detection ship in response to supply chain pressure</h2>
<p>Astral added two security features to uv. The uv audit command scans dependencies against OSV and claims 4-10x faster results than pip-audit. The more interesting addition is UV_MALWARE_CHECK=1, an experimental flag that runs a lightweight OSV-based malware check on every sync operation, blocking known malicious packages before they can execute their .pth hooks. The post is honest about the limitation: malware demands immediate remediation and can bypass PyPI quarantine via lockfile direct references to object storage, so the check is a layer of defense, not a complete solution. Future plans include vulnerability-aware dependency resolution and reachability-based alert filtering. <a href="https://app.daily.dev/feed-by-ids?id=wuU9roi2k&amp;id=FCT3l9tVn" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Django Software Foundation raises 2026 fundraising goal to $500K</h2>
<p>The DSF increased its target from $300K to $500K to fund Fellows, infrastructure, and an Executive Director hire. DjangoCon US 2026 talk lineup is set for August 24-26. Notable commits this cycle include a new listurls management command, a CVE fix for SIGNED_COOKIE_LEGACY_SALT_FALLBACK, and JSON encoder improvements. The uv audit feature mentioned above also landed in Django News this week as a recommended tool for dependency vulnerability scanning. <a href="https://app.daily.dev/posts/FCT3l9tVn" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Python 3.14.6 and 3.13.14 maintenance releases:</strong> Python 3.14.6 ships roughly 179 bugfixes and build improvements since 3.14.5; 3.13.14 ships roughly 240 since 3.13.13 — both available now on <a href="http://python.org" target="_blank" rel="noopener nofollow">python.org</a>. <a href="https://app.daily.dev/feed-by-ids?id=TnqG8mA5v&amp;id=FCT3l9tVn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GRPO fine-tuning lifts Qwen3-8B structured output from 62% to 82% schema validity:</strong> Using Fireworks’ Training API with a three-tier reward function (0.0 unparseable, 0.5 valid JSON wrong schema, 1.0 schema-valid), 200 training prompts on H200 GPUs pushed Qwen3-8B past GPT-4.1’s 58% on JSON invoice extraction — the approach generalizes to any task where correctness can be defined in code. <a href="https://app.daily.dev/posts/bRTqiBCtK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Halodoc cut LLM token costs 5-15% by replacing JSON with TOON format in prompts:</strong> TOON eliminates JSON’s syntactic overhead and represents arrays as CSV-style tables; evaluated at ~95% LLM compatibility across OpenAI, Anthropic, Google, and AWS Bedrock, with a shared Python SDK handling JSON-to-TOON conversion and per-use-case rollout flags. <a href="https://app.daily.dev/posts/4ovM5tbDi" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Django bulk_create cut a 180,000-row nightly import from 3 hours to 4 minutes:</strong> Replacing per-row save() calls with bulk_create() eliminated 180,000 individual INSERT round trips — a 45x speedup that’s directly actionable for anyone running batch imports in Django. <a href="https://app.daily.dev/posts/NnCSOWMKN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apple ships fm CLI and Python SDK for on-device Foundation Models on macOS 27:</strong> The pre-installed fm command-line tool and a Python SDK (requires Python 3.10+, Apple Silicon, Xcode) expose Apple’s on-device models with tool calling, guided generation, and streaming — the primary use case shown is building eval pipelines in Jupyter before shipping Swift features. <a href="https://app.daily.dev/posts/1rbSQWAyp" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Django, FastAPI, Flask, and Python ecosystem updates.

Python Digest

The Shai-Hulud supply chain campaign has expanded to 471 malicious artifacts across PyPI and npm, now targeting bioinformatics, graph ML, and MCP/AI developer packages via trojanized native extensions, .pth hooks, and a langchain-core-mcp loader variant. A related Hades Campaign variant adds cross-platform memory scraping, AES-256-GCM encrypted exfiltration, three GitHub-based C2 channels, and a wiper that destroys the victim's home directory if the stolen GitHub token is revoked. Both campaigns use adversarial prompt injection to evade LLM-based security analyzers. Astral responded by shipping uv audit (4-10x faster than pip-audit) and an experimental UV_MALWARE_CHECK=1 flag that blocks known malicious packages on sync. On the ecosystem side, the Django Software Foundation raised its 2026 fundraising goal from $300K to $500K to fund Fellows, infrastructure, and an Executive Director hire. Python 3.14.6 and 3.13.14 maintenance releases are also out.

Shai-Hulud spreads to 471 artifacts, Django raises $500K fundraising goal