Shai-Hulud npm worm resurfaces, bypassing security scans
A dangerous npm package worm called Shai-Hulud has reappeared. Attackers hide malicious code inside fake packages so your project downloads and runs it without warning.
- Report priority
- Medium
How it works
- Attackers upload fake npm packages with the same name as popular ones.
- When developers install them, the packages secretly run a worm that spreads to other npm packages in the project.
- The worm's code matches the original May attack, meaning it can bypass security tools that only check for known malicious hashes.
What to do
Check if you've installed any of these packages by running npm list shai-hulud shai-hulud-core shai-hulud-utils shai-hulud-cli in your project folder. If any appear, remove them immediately with npm uninstall shai-hulud shai-hulud-core shai-hulud-utils shai-hulud-cli.
Run this in the application environment you want to check:
npm list shai-hulud shai-hulud-core shai-hulud-utils shai-hulud-cliUninstall the packages right away. Then update your npm client to the latest version with npm install -g npm@latest to prevent future infections. Check your project's dependencies for any suspicious or unused packages.
Technical details
A developer installs a fake version of a widely used npm package. The package's code runs automatically, infecting other packages in the project with the Shai-Hulud worm. The worm then tries to spread to other developers' projects by pushing infected packages to npm.
Researchers at Aikido Security discovered four packages containing the Shai-Hulud worm, which had the same malicious payload hash as the original attack from May.