Peeling the Sandworm

reverse-engineering deep-dive on a typosquatted PyPI package sitting one keystroke from NumPy that turned out to be a self-propagating credential worm (Shai-Hulud-class, Hades wave).

What made it worth peeling apart:

- It runs before any of your code does, a .pth file fires on every Python start, no import required.

- It ships a full, working copy of NumPy as cover, so nothing looks broken.

- The payload hides behind four nested layers of obfuscation, the innermost a hand-rolled cipher I had to reimplement to read it.

- There's no attacker server anywhere, exfiltration and worming both ride GitHub and your own stolen token.

Full write-up with IOCs, YARA + KQL hunting rules — https://meltedinhex.com/posts/shai-hulud-nhmpy-pypi/