---
id: 2633
title: "Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting"
source_domain: about.gitlab.com
source_url: "https://about.gitlab.com/blog/shai-hulud-copycat-campaign-targets-python-developers/"
published_at: "2026-06-09 00:00"
tags: ["supply-chain", "malware", "credential-theft", "pypi", "python", "shai-hulud", "typosquatting"]
phying_url: "https://phying.com/item/2633"
lang: en
---

# Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting

## Summary

GitLab researchers found five malicious PyPI packages, including typosquats of Flask, Requests, and NumPy, that deploy the Shai-Hulud worm via .pth files to steal CI/CD credentials.

## Intelligence Metadata

- **Sources:** about.gitlab.com
- **Published:** 2026-06-09 00:00
- **Original:** https://about.gitlab.com/blog/shai-hulud-copycat-campaign-targets-python-developers/
- **Phying News:** https://phying.com/item/2633