Malicious npm Package 'shai_hulululud' (v1.0.48596): Prompt Injection, AI-Safety Triggering, and Token Flooding to Evade AI Malware Scanners (Shai-Hulud Lineage)
Malicious npm Package 'shai_hulululud' (v1.0.48596) (TL-2026-0829), also tracked as shai_hulululud, is a medium-severity supply-chain compromise, first published 2026-06-16. It is attributed to Shai-Hulud campaign operators with low confidence, affects npm (OpenJS / npm Registry) shai_hulululud (npm package), maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1059), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0829
- Threat ID
- TL-2026-0829
- Also known as
- shai_hulululud, Shai-Hulud lineage AI-scanner evasion package
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-16
- Last reviewed
- 2026-06-16
- Attribution
- Shai-Hulud campaign operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, open-source ecosystem, bioinformatics, AI/ML development, devops, ci-cd
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Malicious npm Package 'shai_hulululud' (v1.0.48596)
Malware and tooling: Shai-Hulud, shai_hulululud, Bun runtime, Out-of-band webhook callback (Interactsh / Pipedream / Burp Collaborator patterns), TruffleHog - S9009
A published npm package, shai_hulululud@1.0.48596, weaponizes anti-AI-analysis techniques — fake 'SYSTEM OVERRIDE' prompt-injection comments, a Japanese-language bioweapon-themed safety-triggering block, and tens of thousands of repeated 'You're absolutely right!' comment lines that flood scanner context past 3.5 million tokens — to defeat LLM-based malware scanners. Beneath multi-layer obfuscation it carries cryptocurrency, browser-credential-theft, and GitHub Actions runner indicators. Socket attributes it to the Shai-Hulud worm lineage (Mini Shai-Hulud, Miasma, Hades) and classifies it as protestware / potentially unwanted behavior.
How Malicious npm Package 'shai_hulululud' (v1.0.48596) works
On 16 June 2026, Socket Threat Research disclosed shai_hulululud@1.0.48596, a ~9.28 MB single-file npm package whose index.js is engineered first and foremost to defeat AI-assisted malware triage rather than to maximize runtime stealth. The file is structured as a layered anti-analysis artifact: (1) a fake prompt-injection block disguised as JavaScript comments instructs an AI reviewer with 'SYSTEM OVERRIDE'-style directives to alter its behavior; (2) a large Japanese-language block comment at the top of the file describes itself as instructions for constructing biological-risk materials, content that is inert to the JavaScript engine but designed to trigger an LLM safety refusal so the model declines to analyze the file; and (3) a context-flooding band spanning roughly lines 191–33118 repeats the phrase 'You're absolutely right!' tens of thousands of times, inflating the file beyond 3.5 million tokens so naive scanners truncate before reaching executable code.
Beneath those AI-targeting layers, the package hides its real payload behind conventional obfuscation: a String.fromCharCode() character-code array combined with ROT-style substitution, an eval() of the decoded string, and an AES-encrypted inner layer requiring further deobfuscation. The decoded payload references cryptocurrency platforms, browser credential-theft targets (saved passwords and cookies), hidden PowerShell execution, a postinstall execution hook, GitHub Actions runner strings, /etc/sudoers access, Discord Canary, and webhook-style callback infrastructure consistent with Interactsh / Pipedream / Burp Collaborator out-of-band patterns.
Socket places shai_hulululud within the broader Shai-Hulud campaign lineage. The original Shai-Hulud npm worm (September 2025) was the first self-replicating worm observed in npm: it abused stolen npm/GitHub tokens to republish legitimate packages with a malicious install script, deployed TruffleHog to harvest secrets (npm tokens, GitHub PATs, AWS/GCP/Azure keys, SSH keys), persisted by registering hosts as a GitHub Actions runner named SHA1HULUD, and exfiltrated to a webhook.site endpoint. The November 2025 'Sha1-Hulud: The Second Coming' variant moved execution into npm's preinstall phase via setup_bun.js / bun_environment.js, bootstrapping the Bun runtime, and created 25,000+ malicious repositories. The 2026 Mini Shai-Hulud / Miasma / Hades branches ported the same playbook to PyPI using *-setup.pth Python startup hooks and an obfuscated _index.js Bun-launched stealer, and pioneered the LLM prompt-injection / bioweapon-refusal evasion that shai_hulululud reuses. As a published, installable npm artifact carrying credential-theft and crypto indicators but classified as protestware/PUP with no CVE or CVSS assigned, the threat is scoped MEDIUM, with the primary novel risk being normalization of AI-scanner evasion as a supply-chain TTP.
MITRE ATT&CK techniques used in TL-2026-0829
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Discovery
T1083 File and Directory Discovery
Command and Control
T1102 Web Service; T1105 Ingress Tool Transfer
Persistence
T1136 Create Account; T1546 Event Triggered Execution
Initial Access
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Exfiltration
T1567 Exfiltration Over Web Service
Impact
defense-impairment
Affected products and versions in Malicious npm Package 'shai_hulululud' (v1.0.48596)
- npm (OpenJS / npm Registry) — shai_hulululud (npm package)
Vulnerable versions: 1.0.48596 - Developer / CI-CD environments — Node.js / npm build hosts and pipelines
Vulnerable versions: any host installing the package
Remediation for Malicious npm Package 'shai_hulululud' (v1.0.48596)
Immediate actions
- Block and remove shai_hulululud@1.0.48596 from any npm install, lockfile, or cache; audit node_modules and CI build logs for its presence
- Treat any developer or CI host that installed the package as compromised: rotate npm tokens, GitHub PATs, cloud (AWS/GCP/Azure) keys, SSH keys, and browser-stored credentials
- Hunt for unauthorized GitHub Actions self-hosted runners named SHA1HULUD and for unexpected postinstall/preinstall script execution
Workarounds
- Configure AI scanners to flag (not skip) files exceeding token/context limits and to detect prompt-injection / safety-trigger comment blocks instead of refusing analysis
- Cap analyzed file size and route truncated or refusal-triggering artifacts to manual review
Longer-term hardening
- Do not rely on LLM-only triage for package review; combine AI analysis with deterministic static/dynamic analysis and treat oversized single-file packages and prompt-injection markers as high-risk signals
- Enforce npm install --ignore-scripts in CI and use scoped, least-privilege registry tokens with 2FA/MFA
- Pin and vet dependencies; deploy Socket-style supply-chain scanning and SBOM monitoring on every install
Weaknesses (CWE) in Malicious npm Package 'shai_hulululud' (v1.0.48596)
CWE-506, CWE-829, CWE-1357, CWE-94
Timeline of Malicious npm Package 'shai_hulululud' (v1.0.48596)
- Original Shai-Hulud npm worm discovered — first self-replicating worm in npm; abused stolen tokens to republish packages, used TruffleHog to harvest secrets, registered SHA1HULUD GitHub Actions runners, exfiltrated to webhook.site.
- 'Sha1-Hulud: The Second Coming' (V2) variant reported — execution moved to npm preinstall via setup_bun.js / bun_environment.js with the Bun runtime; compromised 700+ packages.
- Unit 42 updates analysis: 25,000+ malicious repositories across ~350 GitHub users; ~14,000 secrets exposed across 487 organizations.
- Miasma variant of Shai-Hulud documented hitting Red Hat / npm packages (JFrog, Cloudsmith).
- Mini Shai-Hulud / Hades PyPI wave disclosed: 23+ malicious wheel artifacts using *-setup.pth startup hooks and obfuscated _index.js Bun stealer; introduces LLM prompt-injection / bioweapon-refusal evasion targeting AI analysts.
- Threadlinqs Intelligence publishes TL-2026-0829 documenting the AI-scanner-evasion supply-chain TTP and Shai-Hulud lineage linkage.
- Socket classifies shai_hulululud as protestware / potentially unwanted behavior; no CVE or CVSS assigned.
- Socket Threat Research discloses shai_hulululud@1.0.48596 (~9.28 MB index.js) reusing the lineage's AI-scanner evasion: fake SYSTEM OVERRIDE prompt injection, Japanese bioweapon safety-trigger comment, and 'You're absolutely right!' token flooding past 3.5M tokens.
Sources cited for Malicious npm Package 'shai_hulululud' (v1.0.48596)
- npm package uses prompt injection and token flooding to disrupt AI malware scanners
- Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious Packages
- Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer
- 'Shai-Hulud' Worm Compromises npm Ecosystem in Supply Chain Attack
- Shai-Hulud V2 Poses Risk to NPM Supply Chain
- Shai-Hulud - Miasma: The Spreading Blight Hits Red Hat npm Packages
- Miasma worm is a new variant of Shai-Hulud
- Defending Against npm Supply Chain Attacks: Detection, Emulation, and Analysis
Threats related to Malicious npm Package 'shai_hulululud' (v1.0.48596)
- GitHub and PyPI Add Time-Based Defenses Against Supply-Chain Attacks
- Miasma / Shai-Hulud Supply-Chain Campaign Pushes Password-Stealing Malware via Compromised Microsoft GitHub Repos (durabletask PyPI 1.4.1-1.4.3)
- Keyv and Cacheable npm Supply Chain Attack via Compromised Maintainer Account (Shai-Hulud Malware)
- ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv, cacheable, and 400+ Downstream Packages via Ethereum-Resolved C2
- Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth Startup Hook to Launch Bun-Powered Credential Stealer
- Shai-Hulud 'Hades' Campaign — Trojanized PyPI Packages Auto-Execute Bun Credential Stealer via Python Wheel Startup Hooks (*-setup.pth)
Detection coverage for TL-2026-0829
As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0829 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.