# Shai-Hulud detection tool shipped functional malware as AI-generated test files

> G DATA reports that an open-source detector for the Shai-Hulud npm worm shipped test files that were functional malware, including PowerShell scripts that delete user directories and code that uploads data to real threat actors. G DATA assumes no malicious intent: the files were likely AI-generated (vibe-coded) and are not executed in normal use. The maintainer neutralized them on 2026-02-17.

- **Published:** 2026-10-16T18:28:20Z
- **Last reviewed:** 2026-10-16T18:28:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3766
- **ID:** TL-2026-3766
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** RESOLVED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-02-16 G DATA (authors Tim Berghoff and Karsten Hahn) published 'Testing with live malware: Good Intentions, Problematic Execution'. The issue surfaced when a customer submitted the test files of a Shai-Hulud detection program to G DATA as suspected false detections. G DATA reviewed both the files and the program's source Git repository and found that the files were not inert simulations but exhibited real malicious behavior.

The files included PowerShell scripts that delete user directories (recursive file deletion), code that uploads data to threat actors, and credential-theft logic targeting environment variables and .npmrc files, i.e. a one-to-one replica of Shai-Hulud behavior. Comments inside the files labeled them 'SIMULATED MALICIOUS SCRIPT'. G DATA suspected that at least parts of the tool were developed with AI assistance ('vibe coding') and that an LLM, asked to produce files mimicking the worm, reproduced its behavior literally rather than generating safe stand-ins.

Risk: the files were not executed during normal operation of the detector. The danger was to users browsing the program folder who might double-click or run a test file, causing data loss (deleted user directories) or data exposure (upload to real threat actors). A secondary risk is accidental malware distribution through a security tool's repository and downstream copies. The article lists no CVEs, hashes, URLs, IPs or versions, and does not name the tool or maintainer; no attribution to a threat actor is made. The maintainer neutralized the test files on 2026-02-17, so the issue is resolved at source, but forks, clones and archived copies made before that date may still contain the functional files.

Background: Shai-Hulud is a self-replicating npm worm (first mass compromise in September 2025, >500 packages per CISA) that harvests environment variables, GitHub PATs and cloud API keys (AWS, GCP, Azure), exfiltrates them to an actor endpoint and to public GitHub repositories named 'Shai-Hulud', and republishes compromised packages using stolen npm credentials. Detection tooling for it is widely used, which makes accidentally live test corpora a notable hygiene lesson for security-tool authors using LLMs.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction

## Sources

- [Testing with live malware: Good Intentions, Problematic Execution (G DATA)](https://blog.gdatasoftware.com/2026/02/38370-malware-in-test-files)
- [Widespread Supply Chain Compromise Impacting npm Ecosystem (CISA)](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem)
- [CISA urges orgs to review software after 'Shai-Hulud' supply chain compromise (The Record)](https://therecord.media/cisa-urges-software-reviews-malicious-packages)
- [New wave of widespread supply chain compromise impacting npm ecosystem (NCSC NZ)](https://www.ncsc.govt.nz/alerts/supply-chain-compromise-impacting-npm-ecosystem/)
- [Shai-Hulud malware in-depth analysis (SlowMist)](https://slowmist.medium.com/shai-hulud-malware-in-depth-analysis-open-source-means-loss-of-control-ca49cdc06bf7)
- [Shai-hulud Worm Spreads via NPM Packages to Steal Data and Self-Propagate (ThaiCERT)](https://www.thaicert.or.th/en/2025/09/18/shai-hulud-worm-spreads-via-npm-packages-to-steal-data-and-self-propagate/)
- [Shai-Hulud: Widespread npm Supply Chain Attack (SOC Prime)](https://socprime.com/?p=42382)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3766