Shai-Halud Reinfects NPM in 4 Packages as Repository Scanning Misses Known Worm
Updated
Updated · Hackaday · Sep 11
Shai-Halud Reinfects NPM in 4 Packages as Repository Scanning Misses Known Worm
2 articles · Updated · Hackaday · Sep 11
Summary
Four NPM packages uploaded on Sept. 7 carried the original Shai-Halud worm, ending a 111-day lull in infections, according to Aikido.dev researcher Charlie Eriksen.
The code was not a new variant but an exact match to known public signatures, indicating NPM's upload-scanning system failed to catch a previously identified major threat.
Shai-Halud was among the package-repository worms that spread in spring 2026 by stealing credentials and tokens, then infecting every linked package while planting backdoors and targeting crypto wallets.
The miss raises broader doubts about NPM's claim that it scans every uploaded package: if known malware passes through, newer threats may be even harder to stop.
Could the massive scale of recent software patches actually signal a breaking point for the global open-source supply chain?
With AI uncovering complex exploit chains, are human defenders losing the race against automated vulnerability discovery in enterprise systems?
If your smart TV logs everything you watch, is isolating it on a guest network enough to protect your privacy?
ChainDrop: Anatomy and Impact of the 2026 npm Supply Chain Worm That Compromised 444 Packages in 4 Hours
Overview
On August 4, 2026, TeamPCP launched the ChainDrop supply chain worm by exploiting a misconfigured OIDC trusted publisher in the TanStack project. Attackers staged a malicious payload in a GitHub fork using an orphaned commit, which triggered a workflow run and obtained a valid npm publish token. This allowed them to publish dozens of malicious package versions without permanent credentials. The worm used npm's OIDC Trusted Publishing to deliver infected packages with valid SLSA provenance, making them appear safe to automated scanners. During installation, a preinstall hook downloaded and executed an obfuscated payload that harvested credentials, republished itself, and established deep persistence in developer tools, enabling rapid, undetected spread across the ecosystem.