Shai-Hulud source leak is turning npm malware into a copycat problem

The Shai-Hulud malware source code leak has led to the emergence of copycat malware targeting the npm ecosystem. This situation increases the risk of new malware variants appearing that mimic the original Shai-Hulud worm. The leak was reported on Reddit's cybersecurity community and has been identified as a medium-severity threat due to its potential to facilitate remote code execution (RCE) attacks through malicious npm packages. No specific affected versions or exploits in the wild have been confirmed. There is no information about available patches or official remediation. The threat is primarily notable for increasing the volume and diversity of npm malware through source code reuse.

• securityaffairs.com/192366/malware/shai-hulud-worm-copycats-emerge-after-source-code-leak.html (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1thlkw4/shaihulud_source_leak_is_turning_npm_malware_into/ (opens in a new tab)

• Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool2026-10-28
• Fresh WordPress Vulnerability in Attackers’ CrosshairsHighVulnerability2026-10-30
• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29