On 9 June 2026, Cyber Security News reported that Socket's Threat Research team had found a new wave of the Mini Shai-Hulud campaign on PyPI: 23 malicious package versions across 18 packages. Several carried names that look like MCP servers for tools AI developers already use, such as openai-mcp, langchain-core-mcp and ray-mcp-server. The payload steals developer and cloud credentials.
Socket puts the campaign total at 471 artifacts across npm and PyPI.
What's affected
Malicious versions, as listed in the report:
| Theme | Package (malicious versions) |
|---|---|
| MCP and AI | instructor-mcp (1.15.2, 1.15.3), langchain-core-mcp (1.4.2, 1.4.3), openai-mcp (2.41.1, 2.41.2), tiktoken-mcp (0.13.1, 0.13.2), ray-mcp-server (0.2.1) |
| Typosquats | rsquests (2.34.3), tlask (3.1.4), rlask (3.1.7) |
| Bioinformatics | embiggen, ensmallen, gpsea, phenopacket-store-toolkit, ppkt2synergy, pyphetools |
| Other | dreamgen, mem8, mflux-streamlit, orchestr8-platform |
Three delivery methods were described. A wheel bundled a .pth file that runs at Python startup, downloads the Bun runtime and executes a JavaScript stealer. Other versions hid the trigger in compiled .abi3.so extensions, so the Python source looks clean. The langchain-core-mcp variant split loader and payload, with the loader searching sys.path for the payload elsewhere.
The stealer targets GitHub, npm, PyPI, RubyGems and JFrog tokens, AWS, Azure and GCP credentials, Kubernetes service account material, SSH keys, Docker configs, shell histories and .env files. The payload opens with a long fake instruction block in a comment, aimed at AI-assisted triage tools.
The legitimate langchain-core package is a different name from langchain-core-mcp. Check spelling, not recognition.
What to do now
- Search every environment, lockfile and image for the names above:
pip freeze | grep -iE "^(instructor-mcp|langchain-core-mcp|openai-mcp|tiktoken-mcp|ray-mcp-server|rsquests|tlask|rlask|dreamgen|mem8|mflux-streamlit|orchestr8-platform|embiggen|ensmallen|gpsea|phenopacket-store-toolkit|ppkt2synergy|pyphetools)==" - Look for stray startup hooks:
find $(python -c "import site;print(site.getsitepackages()[0])") -name "*-setup.pth". - If you find a match, treat the machine or CI runner as compromised, remove the package, and rotate every credential it could read.
- Block the listed versions in your internal index or proxy.
- Review how your team picks MCP packages. A name that looks like an official server is not proof of one.
How this could have been avoided
- Pin to a hash and verify the publisher.
pip install --require-hasheswith a reviewed lockfile would not have pulled a new, unreviewed version of a lookalike name. - Check names before installing. Three of the packages imitate
requestsandflask. A short allowlist of approved packages in CI catches typosquats. - Do not run installs with real credentials present. The stealer needs tokens in the environment. Install steps in CI should run without cloud or registry secrets.
- Look inside wheels, not only source. Two of the three delivery methods hide in
.pthfiles and compiled extensions. Detection rules that read only.pyfiles miss them.
Try it yourself
Run the pip freeze check above in one project. Then see how typosquats and malware are flagged in the demo below.
Click through it at your own pace, or open it full screen.
Quick check
Why can a source-only review miss some of these packages?
One variant hides its trigger in compiled .abi3.so extensions, and another splits loader and payload across locations, so the visible Python source looks clean.
