Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm Registry

Cybersecurity researchers have disclosed a new Shai-Hulud variant found on the npm registry, embedded in the package "@vietmoney/react-big-calendar" which was uploaded in March 2021 by user "hoquocdat" and updated on 28 December 2025 to version 0.26.2. The package has been downloaded 698 times since its initial publication, with 197 downloads of the latest version noted.

Aikido spotted the package, and according to Aikido, there has been no major spread or infections yet, suggesting attackers may be testing their payload; security researcher Charlie Eriksen said the differences in the code indicate obfuscation from the original source rather than a simple in‑place modification.

The campaign’s significance lies in weaponising npm tokens to fetch about 100 other highly downloaded packages from the same developer, introduce malicious changes, and push them back to npm, effectively expanding a worm‑like supply chain compromise. Notable changes in the new strain include bun_installer.js as the initial file and environment_source.js as the main payload, with secret leakage files named 3nvir0nm3nt.json, cl0vd.json, c9nt3nts.json, pigS3cr3ts.json, and actionsSecrets.json.