Threat reportSupply ChainTL-2026-3766
Shai-Hulud detection tool shipped functional malware as AI-generated test files
Shai-Hulud detection tool shipped functional malware as (TL-2026-3766) is a medium-severity supply-chain compromise, first published 2026-10-16. It has no confirmed attribution, affects Unnamed open-source maintainer Shai-Hulud npm worm detection tool (not, maps to 7 MITRE ATT&CK techniques (T1005, T1059.001, T1195.001), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3766
- Threat ID
- TL-2026-3766
- Severity
- MEDIUM
- Status
- RESOLVED
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, security-vendors
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Shai-Hulud detection tool shipped functional malware as
Malware and tooling: Shai-Hulud, Shai-Hulud detection tool (open-source, name not given by G DATA)
How Shai-Hulud detection tool shipped functional malware as works
G DATA reports that an open-source detector for the Shai-Hulud npm worm shipped test files that were functional malware, including PowerShell scripts that delete user directories and code that uploads data to real threat actors. G DATA assumes no malicious intent: the files were likely AI-generated (vibe-coded) and are not executed in normal use. The maintainer neutralized them on 2026-02-17.
On 2026-02-16 G DATA (authors Tim Berghoff and Karsten Hahn) published 'Testing with live malware: Good Intentions, Problematic Execution'. The issue surfaced when a customer submitted the test files of a Shai-Hulud detection program to G DATA as suspected false detections. G DATA reviewed both the files and the program's source Git repository and found that the files were not inert simulations but exhibited real malicious behavior.
The files included PowerShell scripts that delete user directories (recursive file deletion), code that uploads data to threat actors, and credential-theft logic targeting environment variables and .npmrc files, i.e. a one-to-one replica of Shai-Hulud behavior. Comments inside the files labeled them 'SIMULATED MALICIOUS SCRIPT'. G DATA suspected that at least parts of the tool were developed with AI assistance ('vibe coding') and that an LLM, asked to produce files mimicking the worm, reproduced its behavior literally rather than generating safe stand-ins.
Risk: the files were not executed during normal operation of the detector. The danger was to users browsing the program folder who might double-click or run a test file, causing data loss (deleted user directories) or data exposure (upload to real threat actors). A secondary risk is accidental malware distribution through a security tool's repository and downstream copies. The article lists no CVEs, hashes, URLs, IPs or versions, and does not name the tool or maintainer; no attribution to a threat actor is made. The maintainer neutralized the test files on 2026-02-17, so the issue is resolved at source, but forks, clones and archived copies made before that date may still contain the functional files.
Background: Shai-Hulud is a self-replicating npm worm (first mass compromise in September 2025, >500 packages per CISA) that harvests environment variables, GitHub PATs and cloud API keys (AWS, GCP, Azure), exfiltrates them to an actor endpoint and to public GitHub repositories named 'Shai-Hulud', and republishes compromised packages using stolen npm credentials. Detection tooling for it is widely used, which makes accidentally live test corpora a notable hygiene lesson for security-tool authors using LLMs.
MITRE ATT&CK techniques used in TL-2026-3766
Collection
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Impact
Credential Access
T1552.001 Credentials In Files
Exfiltration
Affected products and versions in Shai-Hulud detection tool shipped functional malware as
- Unnamed open-source maintainer — Shai-Hulud npm worm detection tool (not named in the G DATA article)
Vulnerable versions: Versions containing functional test files prior to 2026-02-17
Fixed in: Repository state after test files neutralized on 2026-02-17
Remediation for Shai-Hulud detection tool shipped functional malware as
Patches
- Maintainer neutralized the functional test files on 2026-02-17
Immediate actions
- Do not open, double-click or execute any test/sample files in Shai-Hulud detector repositories or downloads
- Update to a repository state at or after 2026-02-17 in which the maintainer neutralized the test files
- Delete or quarantine older local clones, forks and archives of the detector that contain the live test scripts
Workarounds
- Exclude or block the detector's test directory from execution and from user-writable launch paths until verified neutralized
Longer-term hardening
- Store malware test corpora as inert, non-executable data (e.g. password-protected archives or pattern-only fixtures) and never as runnable scripts
- Review AI-generated code and test fixtures for functional malicious behavior before committing
- Run security-tool repositories and their samples in isolated VMs
Weaknesses (CWE) in Shai-Hulud detection tool shipped functional malware as
Timeline of Shai-Hulud detection tool shipped functional malware as
- Original Shai-Hulud npm worm first detected (e.g. compromised @ctrl/tinycolor 5.0.3 published with a postinstall credential harvester), starting the first wave that grew past 500 packages.
- Original Shai-Hulud npm worm compromise underway; CISA later advises pinning dependencies to versions published before 2025-09-16.
- CISA publishes alert on the widespread npm supply chain compromise (500+ packages) by the Shai-Hulud worm.
- New wave of the Shai-Hulud npm compromise reported by national CERTs (e.g. NCSC NZ), driving demand for detection tooling.
- G DATA publishes analysis: a Shai-Hulud detector's test files, submitted by a customer as suspected false positives, were found to be functional malware (directory deletion, data upload), likely AI-generated.
- Before publication, a customer submits the detector's test files to G DATA as suspected false detections; G DATA reviews the files and the program's Git repository and finds real malicious behavior (exact submission date not stated).
- Maintainer neutralizes the functional test files, removing the execution risk.
Sources cited for Shai-Hulud detection tool shipped functional malware as
- Testing with live malware: Good Intentions, Problematic Execution (G DATA)
- Widespread Supply Chain Compromise Impacting npm Ecosystem (CISA)
- CISA urges orgs to review software after 'Shai-Hulud' supply chain compromise (The Record)
- New wave of widespread supply chain compromise impacting npm ecosystem (NCSC NZ)
- Shai-Hulud malware in-depth analysis (SlowMist)
- Shai-hulud Worm Spreads via NPM Packages to Steal Data and Self-Propagate (ThaiCERT)
- Shai-Hulud: Widespread npm Supply Chain Attack (SOC Prime)
Detection coverage for TL-2026-3766
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3766 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.