Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief June 09, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we are back on the Chi Hulued supply chain campaign, and it has expanded. Again, this time the target is precise. Developers building AI applications using the model context protocol. Here's what happened. The socket threat research team has identified 23 newly compromised PyPI package version artifacts tied to the ongoing Chihulud campaign, the same threat cluster we covered last week in the context of the NPM Phantom Jip attack. The broader operation, tracked across the mini Chihulud Miasma, and Hades threat clusters. Now spans 471 total artifacts across both npm and pypi. That is 411 npm artifacts across 106 packages and 60 PI artifacts across 37 packages. This campaign is not slowing down. It is accelerating and diversifying. What makes this wave particularly significant? Is the target selection and the delivery method evolution. On target selection, the 23 new artifacts fall into three deliberate thematic clusters. The first targets bioinformatics, legitimate research tools including MBigin, NSMmalIn, GPSEA, Pheno Packet Store Toolkit, and PIFA tools, packages used in genomics workflows, graph learning, and patient phenotyping research. The second cluster is explicitly MCP and AI themed. Langchain-core-mcp, openai-mcp, instructor-mcp, tik token-mcp, and ray-mcp-server. These packages are named to intercept developers actively building model context protocol integrations. The third cluster is typosquatting, RSQuests, Talask, and Rlask. Look-alikes engineered to capture installs from developers working with requests, Flask, and related Python tooling. On delivery evolution, The campaign now operates through three distinct PYPI delivery branches, each designed to bypass a different class of security scanning. The first is a.pth startup hook pattern. A malicious wheel bundles a setup.pth file that fires during Python startup, silently downloading the bun JavaScript runtime and executing the obfuscated payload before any user interaction occurs. The second is a native extension import trigger. Malicious code is embedded directly inside compiled binary extensions. The Python source code appears completely clean. The moment Python loads the module, the extension executes the payload, bypassing source-only review pipelines entirely. The third, and most novel, is the Langchain Core MCP loader variant. The wheel installs a.pth loader but ships without the payload file. Instead, it scans the entire Python environment looking for the payload elsewhere in the file system. This split staging architecture means the loader and the payload never coexist in the same wheel, evading detection rules that rely on that co-location assumption. The payload itself includes a new anti-analysis technique specifically designed to fool AI-assisted triage. It embeds a large fake system instruction block inside a non-executing JavaScript comment at the top of the file. That block is skipped at runtime, but is engineered to trigger safety refusals and context pollution in AI-assisted security review pipelines, causing automated triage to misclassify the file. Before it ever reaches the actual malware. The real payload sits below that block, wrapped in an eval call with a character code substitution cipher. Standard detection methods, YARA rules, entropy analysis, AST parsing, remain effective. Once executed, the Hades Family Payload harvests developer workstation and CI/CD secrets aggressively. GitHub, NPM, PYPI, RubyGems, and JFrog tokens, AWS, Azure, GCP, and Kubernetes credentials, SSH keys, Docker configurations, shell histories, and.env files, and AI developer tool configurations. Here is what you do right now. First, if any of the 23 compromised packages are present in your environment, remove them immediately. The full list includes Dreamgen 1.8.1. MBeggin 0.11.97 and Smallin 0.8.101, GPSEA 0.9.14, Instructor-MCP 1.15.2 and 1.15.3, Langchain Dash Core-MECP 1.4.2 and 1.4.3. OpenAI-MECP 2.41.1 and 2.41.2. TikTokin-MECP 0.13.1 and 0.13.2. And related packages listed in the socket threat research advisory. Treat all credentials from any affected environment as compromised and rotate immediately. Second, audit your Python environments for.pth files that should not be present. Any unexpected.pth file in a site-packages directory is a potential execution hook. Third, do not rely solely on source code review for PyPI packages. This campaign specifically targets source-only review pipelines with binary extension delivery. You need binary analysis in your intake process. Fourth, if you are building MCP integrations right now, Be especially deliberate about every package you install. The naming convention of this wave, OpenAI MCP, Langchain Core MCP, TikTok, and MCP, is engineered to look exactly like the packages you would reach for first. The strategic lesson is direct. AI and MCP developers are now unnamed, targeted demographic and active supply chain campaigns. The attack surface is not just your infrastructure, it is your development environment, your package manager. And the credentials stored on the machines where your code is written. If your security posture treats developer workstations as lower risk endpoints, this campaign is a direct argument for revisiting that assumption. This has been your Digital Warfare Daily Brief. Stay secure, we'll see you tomorrow.