githash
docs
Shai Hulud active
Self-spreading npm and PyPI worm that steals developer and CI credentials.
A credential-stealing worm that spreads by publishing trojanized versions of packages its victims maintain. TeamPCP released the Mini Shai-Hulud source in May 2026, and forks have followed: Miasma (the Red Hat npm compromise), the Hades branch targeting PyPI through .pth startup hooks, and the openapi-react-query-codegen compromise. The payload is re-obfuscated per copy, so individual hashes only confirm samples already seen. Since the source release this is a toolkit used by several operators, not one actor.
- also known as
- Mini Shai-Hulud, Miasma, Hades
references
- https://www.scworld.com/news/teampcp-releases-vibe-coded-shai-hulud-source-code-issues-challenge
- https://www.threatlocker.com/blog/red-hat-npm-packages-compromised-with-credential-stealing-worm
- https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious
- https://socket.dev/blog/openapi-react-query-codegen-npm-compromise
spread over time
Press play to watch the threat spread, or drag the slider to pick dates.
Loading graph…
known-malicious hashes · 63
| sha-256 | file names | repos | files | first seen | last seen |
|---|---|---|---|---|---|
| 927387d0cfac1118… | tasks.json task.json |
39 | 41 | ||
| 2be36c46d3f421bb… | setup.mjs |
19 | 38 | ||
| 26bc468790d3fa35… | index.js |
16 | 16 | ||
| f966d6b3ee5607fc… | setup.js |
1 | 1 | ||
| 7686587715172761… | setup.js |
1 | 1 | ||
| 027b660ba7621927… | setup.js |
4 | 4 | ||
| 1ca20afc06255595… | setup.js |
1 | 1 | ||
| 21e7fdacf8925a39… | setup.js |
1 | 1 | ||
| a5f978977d80e02f… | setup.js |
17 | 17 | ||
| 43cf035a2d112ee5… | setup.js |
2 | 2 | ||
| 38b7c4276246e508… | setup.js |
2 | 2 | ||
| eaaedfaac1e64fc1… | setup.js |
2 | 2 | ||
| 444698ee5ebad67d… | setup.js |
7 | 7 | ||
| 28310778752ee489… | setup.js |
2 | 2 | ||
| 8c7138301c235d01… | index.js |
2 | 2 | ||
| eba17a2d07d6d5a4… | _index.js |
1 | 1 | ||
| 0a441898d44c82f9… | setup.js |
1 | 1 | ||
| 1d031b960e651750… | _index.js |
1 | 1 | ||
| 28f3ce0b83217628… | setup.js |
4 | 4 | ||
| c0cc17983b8577ec… | setup.js |
1 | 1 | ||
| f9bec4a2ab9a0f65… | setup.js |
1 | 1 | ||
| bc41cea8fcc729d7… | setup.js |
4 | 4 | ||
| 412020d6a9026e0c… | index.js |
1 | 1 | ||
| 8e9038c672477dcd… | setup.js |
1 | 1 | ||
| 7314dcf4b3d0b2ea… | setup.js |
1 | 1 |