Shai-Hulud Copycat Worm Infects yet Another Npm Package

Shai-Hulud copycat worm infects yet another npm package

A Shai-Hulud copycat has turned up in yet another npm package just five days after TeamPCP open sourced the worm and announced a supply-chain attack competition on BreachForums. The poisoned package, chalk-tempalte, masquerades as an extension for the popular JavaScript terminal string styling library Chalk. It now contains a clone of Shai-Hulud, which TeamPCP published last week on GitHub after poisoning more than 170 npm packages with the cred…

Leaked Shai-Hulud malware fuels new npm infostealer campaign

The Shai-Hulud malware leaked last week is now used in new attacks on the Node Package Manager (npm) index, as infected packages emerged over the weekend.

Mini Shai-Hulud Copycats and the TanStack Wave: OpenAI Hit, Mistral Extorted, and Four Copycat npm Packages Hit the Registry

OpenAI has disclosed two employee devices were compromised in the May 11, 2026 Mini Shai-Hulud TanStack supply chain attack, with internal source code repositories accessed and iOS, macOS, and Windows code-signing certificates rotated. Mistral AI confirmed one developer device was hit and is facing a $25,000 TeamPCP extortion demand for an alleged 5 GB source code leak. Days later, TeamPCP launched a $1,000 Monero “supply chain attack contest” o…

First Shai-Hulud Worm Clones Emerge

At least one threat actor has adopted the recently released malware source code in attacks against NPM developers. The post First Shai-Hulud Worm Clones Emerge appeared first on SecurityWeek.