Shai-Hulud npm Worm Evades Scanners, Resurfaces After 111 Days

Key Takeaways

• The “Shai-Hulud” npm worm has resurfaced after 111 days, utilizing the exact same malicious payload from a previous supply-chain attack.
• Four new malicious npm packages were published on September 7, demonstrating how known threats can bypass existing malware scanning by being reintroduced in ordinary software.
• The worm compromises developer accounts, steals access tokens, and self-propagates by injecting malicious code into new package versions and republishing them.
• The incident highlights a critical flaw in current npm registry scanning, as an identical, previously identified malicious artifact was able to re-enter the ecosystem.
• Developers must implement stringent security practices, including pinning dependency versions, scrutinizing installation scripts, and regularly rotating API tokens.

A persistent npm worm, dubbed “Shai-Hulud,” has made an unexpected return to the npm registry after a 111-day dormancy period. This resurgence is particularly concerning as the threat re-emerged with an identical malicious payload previously associated with a significant supply-chain compromise.

The reappearance underscores a critical vulnerability in the software supply chain: known malicious code can regain access to development environments when republished within seemingly innocuous software packages. This incident, documented in a detailed report, highlights the ongoing challenge of detecting and preventing the re-entry of previously identified threats.

The Shai-Hulud Worm’s Return

On September 7, four new npm packages were uploaded within a single hour, all containing the familiar malicious payload. When a developer integrates one of these compromised dependencies, the malware executes during the installation process. It then searches for sensitive access tokens and leverages the victim’s publishing privileges to propagate itself into additional packages.

This method of attack mirrors other npm supply-chain incidents where a seemingly trusted update serves as the initial vector for compromise. Security researchers at Aikido identified the returning payload during routine triage, noting that its SHA-256 hash was an exact match for the file observed during the May 19 attack on @antv packages.

Aikido said in a report shared with Cyber Security News (CSN) that this observation confirmed a 111-day gap between the worm’s last known activity and its recent reappearance.

Previous and Current Impact

The initial wave of the Shai-Hulud worm in May was substantial, with a compromised maintainer account pushing 639 malicious @antv package versions within one hour. Aikido’s records indicate that 319 distinct package versions harbored this specific file hash, all detected on May 19. While the current incident involves only four new releases, its significance lies in the fact that the malicious code was already widely recognized and cataloged.

Evasion of Known Malware Detection

The four recently published packages originated from the same npm account. Notably, the threat actors did not attempt to obfuscate or significantly alter the payload. Instead, they reused an identical malicious file, whose cryptographic fingerprint had been publicly known for months. This tactic allowed them to exploit a shortcut into trusted development workflows.

This situation presents a crucial test for existing malware scanning mechanisms. While advanced scanning solutions typically contend with sophisticated evasion techniques such as hidden stages, delayed execution, or environment-specific code changes, this incident involved an exact file-hash match. Consequently, it serves as a direct challenge to the efficacy of known-malware detection rather than a battle against novel evasion.

Worm Functionality and Propagation

Upon execution, the Shai-Hulud payload leverages an install-time script to initiate its malicious activities. It can validate stolen tokens against the npm registry, download existing package archives, inject its malicious code, increment package version numbers, and subsequently republish the altered releases. This automated cycle facilitates rapid worm infections across the npm ecosystem, quickly escalating a single compromised developer account into a widespread supply-chain problem.

Beyond the initial installation, the worm also attempts to establish persistence. It creates project configuration files, such as .vscode/tasks.json and .claude/settings.json, which could enable future execution paths when a repository is opened. Furthermore, the malware generates numerous GitHub repositories with names inspired by “Dune” and reversed “Shai-Hulud” references, a behavioral pattern that can assist defenders in identifying related malicious activity.

What You Should Do

• Review and Audit: Immediately check developer workstations, continuous-integration (CI) pipelines, and build caches for installations of the identified malicious packages: [email protected], [email protected], [email protected], and [email protected].
• Rotate Credentials: Promptly rotate all npm, GitHub, cloud, and any other secrets that may have been exposed on affected systems or through compromised accounts.
• Examine Publications: Scrutinize recent package publications from any potentially compromised accounts for unauthorized or suspicious changes.
• Pin Dependencies: Implement strict dependency pinning to specific, approved versions to prevent automatic updates to potentially malicious new releases.
• Inspect Scripts and Archives: Before promoting new packages or updates, meticulously inspect installation scripts and package archives for any malicious code or unexpected behavior.
• Limit Token Scope and Lifetime: Restrict the permissions and duration of publishing tokens to minimize the impact of a potential compromise.
• Enhance Monitoring: Implement continuous monitoring of publishing activity for all developer accounts and for unusual repository creation patterns, especially those with “Dune”-themed or “Shai-Hulud” related names.
• Be Vigilant: Recognize that dormant malware can resurface without warning through seemingly routine package updates. Maintain a proactive security posture with layered controls and robust threat intelligence.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.