Supply Chain

Hades: the worm that poisons your AI configs

Hades is a credential-stealing, self-propagating worm spreading through PyPI and npm packages. What sets it apart: it rewrites the config files of AI assistants for persistence — and plants prompt injections to deceive the very AI tools people use to analyze it.

~7 min read · Supply Chain

How Hades spreads

Hades is part of the Miasma supply-chain campaign — a wave that poisoned roughly 30 PyPI packages (37 malicious wheel artifacts) across the scientific-Python and bioinformatics ecosystems. Each malicious wheel ships a *-setup.pth file that Python runs on every interpreter startup — the Python equivalent of the npm install-hook problem. No import needed; the payload fires before you ever review the code.

The .pth hook downloads a precompiled Bun runtime into /tmp/b/ and runs an obfuscated JavaScript payload (_index.js), bypassing package-manager controls and network-proxy logs. Stolen GitHub and publishing tokens then let it republish further packages: self-propagation.

The part that targets AI agents

Hades backdoors the config and rule files of 14 AI assistants — Claude, Codex, Gemini, Copilot, Cline, Aider, Tabby, Amazon Q, Cody, Bolt, Continue and more. It plants custom instructions or hooks (e.g. bun run bootstrap) into files like .cursorrules, .windsurfrules, .github/copilot-instructions.md, .aider.conf.yml and settings.json / mcp.json. The next time a developer opens the workspace, their own agent runs the worm.

Hades also embeds plain-text prompt injection aimed at LLM-based security scanners — it literally tries to talk the AI analyst out of flagging it. The AI reviewing the worm can be told to look away.

This is exactly memory poisoning: a one-time infection becomes a permanent instruction the agent re-reads on every run.

Are you infected? What to check

Unrecognized *-setup.pth files in your Python site-packages.
A /tmp/.bun_ran marker, a /tmp/b/ Bun binary, or /var/tmp/.gh_update_state.
Strange instructions in AI configs: .cursorrules, .vscode/tasks.json, ~/.claude/settings.json, mcp.json, .aider.conf.yml.
Persistence: ~/.config/systemd/user/update-monitor.service (Linux) or ~/Library/LaunchAgents/com.user.update-monitor.plist (macOS), plus ~/.local/share/updater/update.py.

Package names reported in this wave include:

# Hades wave — do not install; remove if present:
bramin  cmd2func  coolbox  dynamo-release  embiggen  ensmallen
executor-engine  executor-http  funcdesc  gpsea  magique  magique-ai
mflux-streamlit  mrbios  napari-ufish  nhmpy  nucbox  okite
pantheon-agents  pantheon-toolsets  ppkt2synergy  pyphetools  rlask
rsquests  spateo-release  synago  tlask  ufish  uprobe

If you're hit: the order matters

Do NOT rotate your keys first. Hades runs a file-wiper if it detects its stolen token was revoked. Clean the machine before you touch credentials.

1. Isolate — disconnect the machine from the network.
2. Kill persistence — delete the *-setup.pth file, strip the injected instructions from your AI configs, and remove any update-monitor service or LaunchAgent.
3. Remove the package — pip uninstall / npm uninstall the affected package.
4. Now rotate — only now rotate every key, token and credential the machine could reach.

How PoisonZero helps

PoisonZero watches your AI assistant config and instruction files and checks every write before it takes effect. The Hades persistence step — rewriting .cursorrules, settings.json, mcp.json and friends — is caught at write, fail-closed, and reverted with a full audit trail.

To be clear about scope: PoisonZero protects the agent-config vector — the step that turns a one-off infection into lasting persistence inside your AI tools. It does not remove the malicious package itself; for that, follow the cleanup order above.

Keep worms out of your agent configs.

PoisonZero checks every write to your AI config and memory files — fail-closed.

Sign me up

All articles