Open Source · · 1 day

safe-action npm package carried Shai-Hulud

JFrog listed 1 safe-action npm package in the May 2026 Shai-Hulud wave. This record scopes those artifacts to their own official distribution surface.

Part of Shai-Hulud hits npm and PyPI campaign

safe-action was a small npm entry in the May 2026 Shai-Hulud campaign, with JFrog listing two affected releases: 1.0.3 and 1.0.4. The name is easy to overlook, but the package still represented an official registry surface that could execute attacker code during install.

Shai-Hulud's power came from where package managers run. A developer workstation or CI runner installing safe-action could expose npm tokens, GitHub credentials, cloud material, and other secrets before any application code imported the package. TeamPCP could then use those credentials to publish more compromised artifacts.

This record keeps the safe-action evidence package-scoped. The broader campaign page carries the shared tooling and infrastructure; this page preserves the package name, versions, dates, and npm distribution URLs needed for inventory checks.

Response should follow the install trail. A match in a lockfile, cache, build image, or CI log is enough to justify credential review, especially if the environment had package-publishing authority during the May 11-12 window.

Notes

  • The network and payload indicators are the campaign-level set JFrog published for this wave, not observations of this package's own bytes. They identify the wave's infrastructure and persistence, and are recorded here so each affected distribution surface carries them. Where a record also lists indicators read from an acquired sample, those are marked as such.
  • Minimal campaign-linked record created to keep Shai-Hulud package evidence scoped by vendor, organization, maintainer account, or package distribution surface.

Appendix · Affected releases

safe-action npm
0.8.4 sha256 ccf140b8…994fa845 download unavailable
0.8.3 sha256 03bff662…60739b56 download unavailable

Indicators

  • file_sha256npm payload 29c729852fce5a53e30a1541d9fec79c915b2e13f1eda94a5978cf0aae0d88d9
  • file_sha256npm payload 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96
  • file_sha256npm payload ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
  • file_sha256npm payload d4a2086ea18f5e39cd867b8b06918a524eabb21d45ea98aad07357b98173458a
  • urlhttps://filev2.getsession.org/file/
  • domainseed1.getsession.org
  • domainseed2.getsession.org
  • domainseed3.getsession.org
  • domainapi.masscan.cloud
  • file~/.local/bin/gh-token-monitor.sh
  • file~/.config/systemd/user/gh-token-monitor.service
  • file~/Library/LaunchAgents/com.user.gh-token-monitor.plist
  • file~/.config/gh-token-monitor/
  • stringShai-Hulud: Here We Go Again
  • stringPUSH UR T3MPRR
  • stringFIRESCALE
  • commit_authorclaude@users.noreply.github.com

References

  1. Shai-Hulud: Here We Go Again - Worm by TeamPCP Hits NPM and PyPIresearch.jfrog.com
  2. TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply Chain Attack - Socketsocket.dev
  3. Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack - Aikidoaikido.dev
  4. Retained jsDelivr member manifest for safe-action 0.8.3data.jsdelivr.com
  5. Retained jsDelivr member manifest for safe-action 0.8.4data.jsdelivr.com
  6. Triage report for the exact shared router_init.js payloadtria.ge
  7. Socket retained file tree for safe-action 0.8.3socket.dev
  8. Socket retained file tree for safe-action 0.8.4socket.dev

Source record: oss/attacks/shai-hulud-safe-action-npm/meta.yaml