Open Source · · 1 day

SuperSurkhet npm packages carried Shai-Hulud

JFrog listed 2 SuperSurkhet npm packages in the May 2026 Shai-Hulud wave. This record scopes those artifacts to their own official distribution surface.

Part of Shai-Hulud hits npm and PyPI campaign

SuperSurkhet entered the May 2026 Shai-Hulud wave through both sides of a small toolchain: @supersurkhet/cli and @supersurkhet/sdk. JFrog listed twelve affected releases across those two npm packages.

CLI and SDK packages are useful to a self-spreading package worm because they often execute in developer contexts. The install may happen on a laptop, build runner, or automation host with npm tokens, GitHub access, cloud credentials, SSH keys, and other secrets available in the environment.

This record scopes the SuperSurkhet artifacts separately from the campaign aggregate. The broader Shai-Hulud page carries TeamPCP's shared tooling and propagation behavior; this page keeps the package names, versions, dates, and registry paths precise enough for exposure checks.

The right response starts with dependency evidence. If either SuperSurkhet package resolved to one of the listed versions during May 11-12, the system that installed it should be treated as a potential credential source and reviewed before it publishes or deploys anything else.

Notes

  • The network and payload indicators are the campaign-level set JFrog published for this wave, not observations of this package's own bytes. They identify the wave's infrastructure and persistence, and are recorded here so each affected distribution surface carries them. Where a record also lists indicators read from an acquired sample, those are marked as such.
  • Minimal campaign-linked record created to keep Shai-Hulud package evidence scoped by vendor, organization, maintainer account, or package distribution surface.

Appendix · Affected releases

@supersurkhet/cli npm
0.0.7 sha256 db989c8a…165dff72 download unavailable
0.0.6 sha256 131df608…37f642b9 download unavailable
0.0.5 sha256 00ea5f4c…18e6c3c1 download unavailable
0.0.4 sha256 6fa7afeb…18e6757f download unavailable
0.0.3 sha256 e98b3e64…8ec42925 download unavailable
0.0.2 sha256 22532b1d…70067380 download unavailable
@supersurkhet/sdk npm
0.0.7 sha256 5a5aedeb…cd224212 download unavailable
0.0.6 sha256 68617aa2…e49653a8 download unavailable
0.0.5 sha256 cec7a409…e586f5c1 download unavailable
0.0.4 sha256 7deb8e1f…0ae3da54 download unavailable
0.0.3 sha256 cc9751f8…ea7b7107 download unavailable
0.0.2 sha256 8a6068bc…b0bc1ee9 download unavailable

Indicators

  • file_sha256npm payload 29c729852fce5a53e30a1541d9fec79c915b2e13f1eda94a5978cf0aae0d88d9
  • file_sha256npm payload 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96
  • file_sha256npm payload ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
  • file_sha256npm payload d4a2086ea18f5e39cd867b8b06918a524eabb21d45ea98aad07357b98173458a
  • urlhttps://filev2.getsession.org/file/
  • domainseed1.getsession.org
  • domainseed2.getsession.org
  • domainseed3.getsession.org
  • domainapi.masscan.cloud
  • file~/.local/bin/gh-token-monitor.sh
  • file~/.config/systemd/user/gh-token-monitor.service
  • file~/Library/LaunchAgents/com.user.gh-token-monitor.plist
  • file~/.config/gh-token-monitor/
  • stringShai-Hulud: Here We Go Again
  • stringPUSH UR T3MPRR
  • stringFIRESCALE
  • commit_authorclaude@users.noreply.github.com

References

  1. Shai-Hulud: Here We Go Again - Worm by TeamPCP Hits NPM and PyPIresearch.jfrog.com
  2. TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply Chain Attack - Socketsocket.dev
  3. Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack - Aikidoaikido.dev
  4. Socket file listing for @supersurkhet/cli 0.0.2socket.dev
  5. Socket file listing for @supersurkhet/cli 0.0.3socket.dev
  6. Socket file listing for @supersurkhet/cli 0.0.4socket.dev
  7. Socket file listing for @supersurkhet/cli 0.0.5socket.dev
  8. Socket file listing for @supersurkhet/cli 0.0.6socket.dev
  9. Socket file listing for @supersurkhet/cli 0.0.7socket.dev
  10. Socket file listing for @supersurkhet/sdk 0.0.2socket.dev
  11. Socket file listing for @supersurkhet/sdk 0.0.3socket.dev
  12. Socket file listing for @supersurkhet/sdk 0.0.4socket.dev
  13. Socket file listing for @supersurkhet/sdk 0.0.5socket.dev
  14. Socket file listing for @supersurkhet/sdk 0.0.6socket.dev
  15. Socket file listing for @supersurkhet/sdk 0.0.7socket.dev

Source record: oss/attacks/shai-hulud-supersurkhet-npm/meta.yaml