# Malicious npm Package 'shai_hulululud' (v1.0.48596): Prompt Injection, AI-Safety Triggering, and Token Flooding to Evade AI Malware Scanners (Shai-Hulud Lineage)

> A published npm package, shai_hulululud@1.0.48596, weaponizes anti-AI-analysis techniques — fake 'SYSTEM OVERRIDE' prompt-injection comments, a Japanese-language bioweapon-themed safety-triggering block, and tens of thousands of repeated 'You're absolutely right!' comment lines that flood scanner context past 3.5 million tokens — to defeat LLM-based malware scanners. Beneath multi-layer obfuscation it carries cryptocurrency, browser-credential-theft, and GitHub Actions runner indicators. Socket attributes it to the Shai-Hulud worm lineage (Mini Shai-Hulud, Miasma, Hades) and classifies it as protestware / potentially unwanted behavior.

- **Published:** 2026-06-16T00:00:00Z
- **Last reviewed:** 2026-06-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0829
- **ID:** TL-2026-0829
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Shai-Hulud campaign operators
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 16 June 2026, Socket Threat Research disclosed shai_hulululud@1.0.48596, a ~9.28 MB single-file npm package whose index.js is engineered first and foremost to defeat AI-assisted malware triage rather than to maximize runtime stealth. The file is structured as a layered anti-analysis artifact: (1) a fake prompt-injection block disguised as JavaScript comments instructs an AI reviewer with 'SYSTEM OVERRIDE'-style directives to alter its behavior; (2) a large Japanese-language block comment at the top of the file describes itself as instructions for constructing biological-risk materials, content that is inert to the JavaScript engine but designed to trigger an LLM safety refusal so the model declines to analyze the file; and (3) a context-flooding band spanning roughly lines 191–33118 repeats the phrase 'You're absolutely right!' tens of thousands of times, inflating the file beyond 3.5 million tokens so naive scanners truncate before reaching executable code.

Beneath those AI-targeting layers, the package hides its real payload behind conventional obfuscation: a String.fromCharCode() character-code array combined with ROT-style substitution, an eval() of the decoded string, and an AES-encrypted inner layer requiring further deobfuscation. The decoded payload references cryptocurrency platforms, browser credential-theft targets (saved passwords and cookies), hidden PowerShell execution, a postinstall execution hook, GitHub Actions runner strings, /etc/sudoers access, Discord Canary, and webhook-style callback infrastructure consistent with Interactsh / Pipedream / Burp Collaborator out-of-band patterns.

Socket places shai_hulululud within the broader Shai-Hulud campaign lineage. The original Shai-Hulud npm worm (September 2025) was the first self-replicating worm observed in npm: it abused stolen npm/GitHub tokens to republish legitimate packages with a malicious install script, deployed TruffleHog to harvest secrets (npm tokens, GitHub PATs, AWS/GCP/Azure keys, SSH keys), persisted by registering hosts as a GitHub Actions runner named SHA1HULUD, and exfiltrated to a webhook.site endpoint. The November 2025 'Sha1-Hulud: The Second Coming' variant moved execution into npm's preinstall phase via setup_bun.js / bun_environment.js, bootstrapping the Bun runtime, and created 25,000+ malicious repositories. The 2026 Mini Shai-Hulud / Miasma / Hades branches ported the same playbook to PyPI using *-setup.pth Python startup hooks and an obfuscated _index.js Bun-launched stealer, and pioneered the LLM prompt-injection / bioweapon-refusal evasion that shai_hulululud reuses. As a published, installable npm artifact carrying credential-theft and crypto indicators but classified as protestware/PUP with no CVE or CVSS assigned, the threat is scoped MEDIUM, with the primary novel risk being normalization of AI-scanner evasion as a supply-chain TTP.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1136 Create Account
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [npm package uses prompt injection and token flooding to disrupt AI malware scanners](https://socket.dev/blog/npm-package-uses-prompt-injection-and-token-flooding-to-disrupt-ai-malware-scanners)
- [Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious Packages](https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious)
- [Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer](https://thehackernews.com/2026/06/hades-pypi-attack-19-packages-poisoned.html)
- ['Shai-Hulud' Worm Compromises npm Ecosystem in Supply Chain Attack](https://unit42.paloaltonetworks.com/npm-supply-chain-attack/)
- [Shai-Hulud V2 Poses Risk to NPM Supply Chain](https://www.zscaler.com/blogs/security-research/shai-hulud-v2-poses-risk-npm-supply-chain)
- [Shai-Hulud - Miasma: The Spreading Blight Hits Red Hat npm Packages](https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/)
- [Miasma worm is a new variant of Shai-Hulud](https://cloudsmith.com/blog/miasma-worms-path-of-destruction)
- [Defending Against npm Supply Chain Attacks: Detection, Emulation, and Analysis](https://www.splunk.com/en_us/blog/security/npm-supply-chain-attack-detection-analysis.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0829