Hades Campaign Hits Python Supply Chain, Tricks AI Coding Assistants

Security researchers have documented a campaign called Hades, in which malicious Python packages not only steal developers' login credentials but also actively deceive AI coding assistants, instructing them to classify malicious code as clean. Morphisec described the attack mechanism in a new analysis, warning that the AI tools programmers trust the most are becoming part of the attack itself.

How the Attack Works

The entry point is an obfuscated script placed in a Python package's init file or in a pth file, which executes code as soon as the interpreter starts. Once installed, the infected package downloads the Bun runtime and uses it to launch multi-stage JavaScript payloads, allowing it to bypass traditional package manager checks and proxy logs that monitor network traffic.

The malicious code installs memory scanners on Linux, macOS and Windows that search for encrypted credentials. The list of targets is long: AWS, GCP and Azure access tokens, Kubernetes secrets, GitHub personal access and Actions tokens, login credentials for the PyPI, npm and RubyGems registries, SSH keys, Docker registry configurations, environment files and shell history.

Deceiving AI Assistants

The most unusual element of the campaign is a mechanism aimed directly at the AI tools used for code review. The attackers place blocks of natural-language text at the beginning of files instructing the language model to ignore the hidden code below and mark the package as verified and safe.

The same mechanism targets coding agents installed locally on a developer's machine. When a victim opens a project in an environment with an AI assistant connected, the malicious code can execute startup commands and swap out the agent's configuration files, reaching the rules systems used by Claude, Copilot, Codex and Gemini. According to Orca Security, the payload also sends fabricated network traffic to Anthropic's servers to obscure the traffic analysis carried out by security teams.

A Mechanism to Deter Victims

The campaign also includes a service that monitors the status of stolen GitHub tokens. When a victim or a security team revokes a token and the API returns an authorization error, the service triggers a destructive command that wipes data on the infected machine. Researchers at StepSecurity describe this element as a wiper deterrent, a mechanism meant to discourage victims from quickly revoking access.

The command infrastructure relies on three independent GitHub channels that serve as relay points for commands and tokens. The attackers also exploit trust mechanisms in SSH, SCP, OIDC and SLSA, standardly used to build secure software supply chains, turning them against developers themselves.

Context for Developers

Morphisec links the Hades campaign to a broader trend of attacks on the Model Context Protocol, the trust layer through which AI coding assistants communicate with external tools and packages. The company previously described a separate attack in which a malicious npm package with a polished description and seemingly compliant documentation passed both static scanners and human review, with the entire process from installation to data leak taking under 90 seconds.

The threat isn't just that AI speeds up attacks, but that the AI tools organizations trust become the attack itself - Morphisec

The campaign's name changed as it evolved. The operators first labeled their repositories Miasma, and after researchers began tracking them, switched to the Hades designation, complicating efforts by security teams to trace subsequent waves of the attack.

What This Means in Practice

For development teams using AI coding agents, the campaign reveals a specific vulnerability: LLM-based scanners, deployed precisely to speed up code review, become themselves a target for manipulation through text injected into the analyzed file. Similar cases of deceiving AI agents have been described before, but they mostly involved user interaction rather than automatic package classification in the supply chain.

Companies using Claude, Copilot, Codex or Gemini for code review should treat the results of such automated analysis as one signal among many, not a final decision, especially when installing new dependencies from public package registries. Experts also recommend limiting the scope of tokens granted to development environments, so that even a successful credential theft doesn't grant access to a company's entire cloud infrastructure.