Hades Cluster: 19 PyPI Packages Compromised via Startup Hook Malware
Researchers at Socket reported the Hades Cluster campaign, where attackers hijacked 19 scientific and deep‑learning PyPI packages and injected malicious *.pth startup‑hook files. The payload installs the Bun runtime to steal developer credentials, cloud tokens, and GitHub/NPM secrets whenever Python starts. Treat any install of the listed packages as compromised.