Open Source · · 1 day

wot-api npm package carried Shai-Hulud

JFrog listed 1 wot-api npm package in the May 2026 Shai-Hulud wave. This record scopes those artifacts to their own official distribution surface.

Part of Shai-Hulud hits npm and PyPI campaign

wot-api was a single-package entry in TeamPCP's May 2026 Shai-Hulud wave. JFrog listed four affected npm releases under the wot-api package name during the May 11-12 exposure window.

The compromise followed the campaign's registry-first model. A normal package install was enough to create risk if it ran in a developer shell, CI runner, or build container with tokens and configuration nearby. The malware's value came from harvesting those credentials and using them to publish additional infected packages.

This record keeps wot-api separate from the larger campaign rollup because package-level evidence is what defenders can search. The campaign page explains the shared TeamPCP loader, infrastructure, and propagation behavior; this page preserves the affected versions and npm distribution paths.

Cleanup should follow every place the affected wot-api releases resolved: lockfiles, caches, package mirrors, build images, and CI logs. Any matching environment should be reviewed for credential theft and downstream publishing activity before it is trusted again.

Notes

  • The network and payload indicators are the campaign-level set JFrog published for this wave, not observations of this package's own bytes. They identify the wave's infrastructure and persistence, and are recorded here so each affected distribution surface carries them. Where a record also lists indicators read from an acquired sample, those are marked as such.
  • Minimal campaign-linked record created to keep Shai-Hulud package evidence scoped by vendor, organization, maintainer account, or package distribution surface.

Appendix · Affected releases

Indicators

  • file_sha256npm payload 29c729852fce5a53e30a1541d9fec79c915b2e13f1eda94a5978cf0aae0d88d9
  • file_sha256npm payload 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96
  • file_sha256npm payload ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
  • file_sha256npm payload d4a2086ea18f5e39cd867b8b06918a524eabb21d45ea98aad07357b98173458a
  • urlhttps://filev2.getsession.org/file/
  • domainseed1.getsession.org
  • domainseed2.getsession.org
  • domainseed3.getsession.org
  • domainapi.masscan.cloud
  • file~/.local/bin/gh-token-monitor.sh
  • file~/.config/systemd/user/gh-token-monitor.service
  • file~/Library/LaunchAgents/com.user.gh-token-monitor.plist
  • file~/.config/gh-token-monitor/
  • stringShai-Hulud: Here We Go Again
  • stringPUSH UR T3MPRR
  • stringFIRESCALE
  • commit_authorclaude@users.noreply.github.com

References

  1. Shai-Hulud: Here We Go Again - Worm by TeamPCP Hits NPM and PyPIresearch.jfrog.com
  2. TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply Chain Attack - Socketsocket.dev
  3. Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack - Aikidoaikido.dev
  4. Socket retained file tree for wot-api 0.8.1socket.dev
  5. Retained jsDelivr flat member manifest for wot-api 0.8.2data.jsdelivr.com
  6. Retained jsDelivr flat member manifest for wot-api 0.8.3data.jsdelivr.com
  7. Retained jsDelivr flat member manifest for wot-api 0.8.4data.jsdelivr.com
  8. Upstream wot-api tree used for eight exact ordinary-asset overlaysgithub.com

Source record: oss/attacks/shai-hulud-wot-api-npm/meta.yaml