Peeling the Sandworm: Reversing the nhmpy PyPI Supply-Chain Worm (Shai-Hulud / Hades Wave)

A highly sophisticated PyPI supply-chain attack used a malicious NumPy typosquat (“nhmpy”) to stealthily harvest developer and CI credentials via a multi-layer obfuscated JavaScript payload, exfiltrating and self-propagating entirely through GitHub using the victim’s own tokens, while evading detection by mimicking legitimate dependencies and abusing platform-native features.