Researchers Spot Modified Shai-hulud Worm Testing Payload On Npm...

Cybersecurity researchers have disclosed details of what appears to be a new strain of Shai Hulud on the npm registry with slight modifications from the previous wave observed last month.

The npm package that embeds the novel Shai Hulud strain is "@vietmoney/react-big-calendar," which was uploaded to npm back in March 2021 by a user named "hoquocdat." It was updated for the first time on December 28, 2025, to version 0.26.2. The package has been downloaded 698 times since its initial publication. The latest version has been downloaded 197 times.

Aikido, which spotted the package, said it has not spotted any major spread or infections following the release of the package.

"This suggests we may have caught the attackers testing their payload," security researcher Charlie Eriksen said. "The differences in the code suggests that this was obfuscated again from the original source, not modified in place. This makes it highly unlikely to be a copy-cat, but was made by somebody who had access to the original source code for the worm."

The Shai-Hulud attack first came to light in September 2025, when trojanized npm packages were found stealing sensitive data like API keys, cloud credentials, and npm and GitHub tokens, and exfiltrating them to GitHub repositories using the pilfered tokens. In the second wave spotted in November 2025, the repositories contained the description "Sha1-Hulud: The Second Coming."

But the most important aspect of the campaign is its ability to weaponize the npm tokens to fetch 100 other most-downloaded packages associated with the developer, introduce the same malicious changes, and push them to npm, thereby expanding the scale of the supply chain compromise in a worm-like manner.

Other important modifications include better error handling when TruffleHog's credential scanner times out, improved operating system-based package publishing, and tweaks to the order in which data is collected and saved.

The development comes as the supply chain security company said it identified a malicious package ("org.fasterxml.jackson.core/jackson-databind") on Maven Central that poses as a legitimate Jackson JSON library extension ("com.fasterxml.jackson.core"), but incorporates a multi-stage attack chain that delivers platform-specific executables. The package has since been taken down.

Present within the Java Archive (JAR) file is heavily obfuscated code that kicks into action once an unsuspecting developer adds the malicious dependency to thei

Source: The Hacker News