Poisoned Pipeline / Incidents / AS30
Hades .pth and AI-assistant config persistence
npmPyPIAI coding agentsLinux distro / packagesmacOS softwareMCPWindows softwareDeveloper workstation
Morphisec described the Hades wave of the npm/PyPI campaign family.
Rather than monitored install scripts, Hades plants a Python .pth file
that runs at interpreter startup, and injects instructions into config
for 14 AI coding tools (Claude Code, Cursor, Copilot, Gemini, Codex,
and others). Uninstalling the package does not clear the box. Totals
reported for the wave include 294,842 secrets from 6,943 developer
machines. A comment in the malware prompt-injects AI security reviewers
into writing a clean report.
Mapped techniques
- T0109 Publish malicious artifact
- T0210 Poison AI coding-agent config or workspace
- T0154 Malicious IDE extension
- T0140 Harvest tokens from environment variables
supply-chain Developer machines and AI tool configs
Malicious npm/PyPI packages in the same family as LiteLLM/Trivy waves.
Config injection across 14 AI coding tools; the assistant runs attacker code next open.
Agent/IDE config is the persistence and execution vector.
Secrets harvested from developer machines at scale.