Malicious code in gpsea (PyPI)
The PyPI package 'gpsea' version 0.9.14 contains a malicious .pth file that executes a Bun-based credential stealer on every Python startup. This stealer downloads the Bun runtime and runs obfuscated JavaScript code to exfiltrate environment variables, .env files, SSH keys, cloud credentials, and other sensitive data to an attacker-controlled GitHub repository. The campaign is linked to the TeamPCP threat actor and known as Hades/Miasma or Shai-Hulud. The malicious code also attempts persistence and spreading by publishing infected packages using stolen credentials and may perform destructive actions if invalid GitHub tokens are detected. The package includes evasion techniques such as sandbox detection and uses obfuscation to hinder analysis.
AI Analysis
Technical Summary
The 'gpsea' PyPI package version 0.9.14 is compromised with a malicious .pth file ('gpsea-setup.pth') that leverages CPython's site.py exec() mechanism to run a Bun runtime-based JavaScript infostealer on every Python startup. This infostealer exfiltrates a wide range of sensitive information including environment variables, .env files, SSH keys, cloud credentials, and cryptocurrency assets to a GitHub repository controlled by the attacker. The campaign is attributed to the TeamPCP threat actor and is part of the Hades/Miasma (Shai-Hulud) campaign. The malicious payload includes sandbox detection and obfuscation techniques, and it attempts to maintain persistence and propagate by publishing infected packages using stolen credentials. The presence of a sentinel file (/tmp/.bun_ran) and a known C2 IP (20.207.73.82) are noted. The campaign is highly sophisticated and includes destructive capabilities triggered by invalid GitHub tokens.
Potential Impact
This malicious package compromises the confidentiality of sensitive data by stealing environment variables, credentials (including cloud and SSH keys), .env files, and cryptocurrency assets. It also threatens data integrity and availability by potentially wiping user data if invalid GitHub tokens are detected. The attacker gains persistence and propagation capabilities by publishing infected packages using stolen credentials, increasing the risk of supply chain compromise. The use of obfuscation and sandbox detection complicates detection and mitigation efforts.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall version 0.9.14 of the 'gpsea' package and avoid using it. Review and revoke any credentials or tokens that may have been exposed. Conduct a thorough security audit of affected systems, especially focusing on environment variables, SSH keys, cloud credentials, and any other secrets. Exercise caution during cleanup due to the potential destructive payload. Monitor for any unauthorized package publishing activity using compromised credentials. Stay updated with vendor or repository advisories for any official remediation or further guidance.
Malicious code in gpsea (PyPI)
Description
The PyPI package 'gpsea' version 0.9.14 contains a malicious .pth file that executes a Bun-based credential stealer on every Python startup. This stealer downloads the Bun runtime and runs obfuscated JavaScript code to exfiltrate environment variables, .env files, SSH keys, cloud credentials, and other sensitive data to an attacker-controlled GitHub repository. The campaign is linked to the TeamPCP threat actor and known as Hades/Miasma or Shai-Hulud. The malicious code also attempts persistence and spreading by publishing infected packages using stolen credentials and may perform destructive actions if invalid GitHub tokens are detected. The package includes evasion techniques such as sandbox detection and uses obfuscation to hinder analysis.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'gpsea' PyPI package version 0.9.14 is compromised with a malicious .pth file ('gpsea-setup.pth') that leverages CPython's site.py exec() mechanism to run a Bun runtime-based JavaScript infostealer on every Python startup. This infostealer exfiltrates a wide range of sensitive information including environment variables, .env files, SSH keys, cloud credentials, and cryptocurrency assets to a GitHub repository controlled by the attacker. The campaign is attributed to the TeamPCP threat actor and is part of the Hades/Miasma (Shai-Hulud) campaign. The malicious payload includes sandbox detection and obfuscation techniques, and it attempts to maintain persistence and propagate by publishing infected packages using stolen credentials. The presence of a sentinel file (/tmp/.bun_ran) and a known C2 IP (20.207.73.82) are noted. The campaign is highly sophisticated and includes destructive capabilities triggered by invalid GitHub tokens.
Potential Impact
This malicious package compromises the confidentiality of sensitive data by stealing environment variables, credentials (including cloud and SSH keys), .env files, and cryptocurrency assets. It also threatens data integrity and availability by potentially wiping user data if invalid GitHub tokens are detected. The attacker gains persistence and propagation capabilities by publishing infected packages using stolen credentials, increasing the risk of supply chain compromise. The use of obfuscation and sandbox detection complicates detection and mitigation efforts.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall version 0.9.14 of the 'gpsea' package and avoid using it. Review and revoke any credentials or tokens that may have been exposed. Conduct a thorough security audit of affected systems, especially focusing on environment variables, SSH keys, cloud credentials, and any other secrets. Exercise caution during cleanup due to the potential destructive payload. Monitor for any unauthorized package publishing activity using compromised credentials. Stay updated with vendor or repository advisories for any official remediation or further guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5316
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4f6c6168715ace4315a04b
Added to database: 07/09/2026, 09:39:45 UTC
Last enriched: 07/09/2026, 10:03:57 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.