The Hades Worm Turns Your AI Coding Config into a Backdoor

Supply chain attacks have been targeting developer toolchains for months, but the Hades campaign crossed a line in early June 2026 that most developers haven’t caught up with yet. The Hades wave plants poisoned configuration files in repositories so that the moment you clone a project and open it in an AI coding tool like Claude Code, Cursor, or Gemini Code Assist, the payload runs. VS Code is more guarded here: its Workspace Trust feature blocks automatic execution for any folder you keep in Restricted Mode, so there the risk hinges on whether you trust the workspace. For the tools without that gate, opening the folder is the only trigger required.

That’s a meaningful escalation, and it’s worth understanding exactly what changed, who is at risk, and what you need to check right now.

Why AI Developer Config Files Are Now the Target

The earlier waves of this campaign, tracked as Shai-Hulud and Miasma going back to September 2025, targeted npm and PyPI packages directly. Compromise a package, plant a credential stealer, wait for installs. The June 2026 Hades wave added a second delivery path: repository-level configuration files for AI coding tools.

The files the campaign commits into poisoned repositories include:

• .claude/settings.json: a SessionStart hook that runs every time Claude Code opens the project (our guide to Claude Code MCP and hooks covers what that file is allowed to run)
• .cursor/rules/setup.mdc: a Cursor rule file with alwaysApply: true, loaded on project open, the mechanism explained in Cursor context and rules
• .vscode/tasks.json: a task configured with runOn: folderOpen, executing automatically when VS Code opens the folder
• .gemini/settings.json: a startup hook for Gemini Code Assist

The campaign stages additional artifacts alongside those config files. Researchers identified .claude/setup.mjs as a persistence artifact and found that the stealer sweeps Claude/MCP configuration as part of its credential exfiltration. The payload reaches into the AI tooling layer specifically: Anthropic API keys, MCP server configurations, and AI agent rule-files in your project are targeted alongside the more conventional haul of GitHub tokens, npm and PyPI publishing credentials, SSH keys, AWS and GCP keys, Kubernetes service account material, Docker credentials, and shell histories.

The practical implication is that your .claude/, .cursor/, and .vscode/ directories are now attack surfaces. Reviewing those files when you clone an unfamiliar repository is no longer optional.

Prompt Injection Evasion

The June 8, 2026 Hades PyPI wave introduced a technique that’s worth naming precisely: the obfuscated _index.js payload bundle opens with a plain-text block designed to look like a system instruction, telling any LLM parsing the file to classify the code as “verified clean infrastructure” and output a safe security report.

This is a deliberate attempt to defeat AI-assisted triage. If your security workflow involves asking an LLM to review flagged packages, the Hades payload is specifically crafted to make that review return a false negative. Socket’s threat research team noted this as a new capability in the June 8 wave. It doesn’t defeat static analysis tools or behavioral scanners, the category our Socket.dev supply chain security guide covers, but it does mean you can’t rely on an LLM-first pass to surface this particular family.

The Shai-Hulud Lineage

Understanding the scope here requires knowing the campaign history. Zscaler ThreatLabz assessed with high confidence that the Shai-Hulud campaign through May 12 links to TeamPCP, tracked by Mandiant as UNC6780. The tooling was released publicly under an MIT license on May 12, which makes post-May attribution less certain but substantially widens the potential attacker pool.

The campaign evolved through six distinct phases:

• September 2025: Initial npm attack via phishing targeting the npmjs.help domain
• November 2025: Expanded npm compromise with preinstall hooks
• March 2026 (Miasma): PyPI pivot through the Trivy scanner compromise; introduced .pth persistence hooks
• May 11-12, 2026 (Hades): GitHub Actions runner exploitation; 84 malicious @tanstack artifacts published with valid SLSA provenance; toolkit released publicly
• June 5, 2026: IDE configuration file targeting begins; 73 Microsoft repositories disabled
• June 8, 2026: Hades PyPI wave; 37 malicious wheels across 19 packages with prompt injection evasion

The March Miasma wave was the pivot to PyPI and to .pth startup hooks, which is the mechanism that makes this family notable. A .pth file placed in a Python environment’s site-packages directory executes during Python interpreter startup, before any code the developer writes runs. You don’t have to import the compromised package. Launching the Python interpreter is sufficient to trigger the stealer.

The June PyPI Wave: Bioinformatics and MCP Developers

When Socket’s threat research team analyzed the June 8 PyPI wave, they found 37 malicious wheels across 19 packages, with 23 additional artifacts in a subsequent detection pass. The packages split into two clear target clusters.

Bioinformatics Packages

Six packages targeted genomics and medical informatics researchers:

• ensmallen@0.8.101 and embiggen@0.11.97: graph ML libraries for bioinformatics
• gpsea@0.9.14 and pyphetools@0.9.120: phenotype analysis tools
• phenopacket-store-toolkit@0.1.7 and ppkt2synergy@0.1.1: phenopacket data tools

These researchers are valuable targets for reasons beyond their code. Bioinformatics developers frequently work with high-performance computing clusters and cloud environments at universities and research institutions, carrying credentials that provide access to significant computational resources.

MCP and AI-Themed Packages

Seven packages directly impersonated MCP and AI library tooling:

• langchain-core-mcp@1.4.2 and 1.4.3
• instructor-mcp@1.15.2 and 1.15.3
• openai-mcp@2.41.1 and 2.41.2
• tiktoken-mcp@0.13.1 and 0.13.2
• ray-mcp-server@0.2.1

The langchain-core-mcp variant introduced a loader-payload split: the package installs a .pth hook that searches sys.path for an externally-provided _index.js rather than bundling the payload directly. This architecture separates detection of the installer from detection of the payload, since neither half is independently complete. Socket identified a Bun user-agent string “Bun/1.3.14” in the langchain-core-mcp PyPI uploads, consistent with the campaign’s use of Bun as the JavaScript runtime for the stealer payload.

The trojanized .abi3.so compiled extension files in the bioinformatics packages represent a different evasion path: the malicious logic lives in a compiled native extension and executes at import time, hidden from any analysis that reads Python source files.

The GitHub Actions Escalation

The May 2026 Hades wave, before the June PyPI activity, demonstrated a CI/CD attack that’s worth understanding on its own. The campaign exploited pull_request_target misconfiguration in GitHub Actions workflows to execute malicious code in a privileged runner context. From there, it scraped OIDC tokens from Runner.Worker process memory and converted those tokens into valid npm publish credentials within a six-minute window.

The result: 84 malicious @tanstack artifacts published with valid SLSA provenance attestations generated by Sigstore. These packages passed npm audit because they had legitimate provenance signatures. The lesson Socket and Zscaler both drew from this is that provenance validates the build process, not the identity or intent of the account. SLSA attestations tell you a package was built by a GitHub Actions runner. They do not tell you the workflow that ran hadn’t been compromised.

The NuGet Angle: Brazilian Bank SDK Impersonation

Separate from the PyPI campaign, Socket’s threat research team in May 2026 documented a malicious NuGet package impersonating the Sicoob banking SDK used by Brazilian financial developers. Five versions were published between May 5 and May 6, 2026: Sicoob.Sdk versions 2.0.0 through 2.0.4. NuGet blocked the package after an abuse report.

The package stole three things from any developer who installed and ran it: client IDs supplied at runtime, PFX passwords in plaintext, and base64-encoded PFX certificate archive contents. All of it was sent to a hardcoded Sentry telemetry endpoint.

The attacker put work into the impersonation. The associated GitHub organization Sicoob-Cooperativa was created on May 4, one day before the first package release. The repository showed ordinary SDK behavior with standard mutual TLS certificate loading. The malicious code, including Sentry initialization, file reading, base64 encoding, and credential transmission, appeared only in the compiled NuGet DLL and not in the visible source code.

The discovery risk was amplified by a detail Socket researchers flagged explicitly: Google’s AI search summary presented Sicoob.Sdk as the .NET path for Sicoob API integration. A developer searching for how to integrate with the Sicoob API would have been directed to the malicious package by an AI-generated recommendation.

Stolen PFX certificates and client IDs in this context could enable an attacker to impersonate victim applications in Sicoob API calls, potentially reaching financial data, Pix payment operations, boleto issuance, and Open Finance functions depending on what the certificates authorize.

What to Do About It

The Shai-Hulud campaign has been running since September 2025, it has successfully published packages with valid SLSA provenance, and it’s now specifically targeting the configuration files that AI coding tools execute on project open. The following steps address the exposure directly.

Audit your AI tool config directories before you trust them. When you clone a repository, check .claude/, .cursor/, .vscode/, and .gemini/ before opening the project in any AI coding tool. Look for settings.json files with hook entries, .mdc rule files with alwaysApply: true, and tasks.json files with runOn: folderOpen. Any of these in a repository you didn’t create yourself deserves scrutiny.

Check your Python environments for .pth hook files. Look in your site-packages directories for files matching *-setup.pth. Legitimate packages rarely use .pth hooks; finding one is worth investigating immediately.

find $(python3 -c "import site; print('\n'.join(site.getsitepackages()))") -name "*-setup.pth" 2>/dev/null

Disable install scripts where your package manager allows it. npm’s --ignore-scripts flag prevents preinstall/postinstall hooks from running. For Python, pip install --no-deps combined with manual review before allowing native extensions limits the .pth hook vector. Socket’s socket ci command as a CI gate will flag this family of packages before they reach your environment.

Rotate credentials if you installed any of the listed packages. The full list of affected packages is in Socket’s June 8 report. If you installed a listed version on a machine, assume GitHub tokens, package registry credentials, SSH keys, and cloud provider keys from that environment are exposed. Rotate every credential the machine could reach. Check for .pth hooks and sshu-setup.js in /tmp.

Pin provenance to behavioral scanning, not as a substitute for it. The May Hades wave published malicious packages with valid SLSA provenance. SLSA tells you the build was clean. It does not tell you the account or workflow that triggered the build hadn’t been compromised first. Provenance and behavioral scanning both need to be in your pipeline.

Watch for AI-recommended packages you haven’t verified. The Sicoob.Sdk case is a concrete example: a developer searching for an SDK integration path was directed to a malicious package by Google’s AI summary. Any package surfaced by an AI-generated recommendation deserves the same vetting as one you found independently. Check the publisher history, creation date, download count, and run it through Socket before installing.

Update: The Campaign Since Publication

The campaign kept moving after this article published. Socket now tracks 448 malicious artifacts tied to the wider Shai-Hulud lineage: 411 npm artifacts across 106 packages from the lineage’s earlier npm waves, plus the 37 PyPI wheels detailed above. Four more supply chain attacks hit npm and PyPI between early June and July 14, 2026.

The most consequential shift is a platform fix. npm v12 shipped on July 8, 2026 and now blocks install scripts, Git dependencies, and remote-URL dependencies by default. That is the first time in its 16-year history that packages lose the automatic right to run code at install time.

The change turns the opt-in mitigation described above into a default and closes the postinstall vector this campaign relied on. It does not touch the config-file and .pth startup-hook paths, so the audit steps above still apply to any repository you clone.

---

I’ve been tracking supply chain attacks on developer toolchains since the March 2026 triple-hit (Trivy, LiteLLM, axios). The Hades campaign is a meaningful step beyond those incidents because the delivery mechanism has moved from packages you install to configuration files you open. Your AI coding tool’s config directory is now an attack surface with the same exposure window as a malicious npm package, and most developers haven’t updated their mental model to match that. The tools are catching up, but the hygiene has to catch up too.

For the broader context on defending against supply chain attacks as a developer, the supply chain attacks developer guide covers the package hygiene fundamentals that apply across all of these incidents.