Peeling the Sandworm: Reversing the nhmpy PyPI Supply-Chain Worm (Shai-Hulud / Hades Wave)

The short version A package called nhmpy showed up on PyPI sitting one keystroke away from NumPy ( n-h-mpy instead of n-u-mpy ). It had already been pulled from the index and the wheel was far larger than NumPy has any reason to be, so I pulled the artifact apart to see what it was really doing. It turned out to be a credential stealer that goes to real trouble not to look like one. The package…