Shai-Hulud returns: the npm worm now rides your AI coding tools

The Shai-Hulud worm is back, and this time you do not have to install anything. Cloning the wrong repository and opening it in VS Code or Claude Code is enough. JFrog identified the new campaign on August 4, starting with keyv and cacheable, two caching libraries that sit as dependencies under thousands of tools. From there the worm reached more than 400 packages across 1,700 versions. OX Security counts over 440 unique npm packages, with downstream projects adding up to more than 2 billion monthly downloads.

The delivery route is the new part. Earlier npm worms triggered on install, through the preinstall script, and this variant still does. But it also plants commands in the settings files your editor trusts: a task definition in .vscode and a SessionStart hook in .claude/settings.json. Open the repository, and the editor or the coding agent runs the payload for you. JFrog’s researchers put it plainly: opening an infected repository is enough to trigger execution.

The attackers moved into the AI tool chain itself too. OX Security found a fake crypto security tool named V.A.P.E registered in the official MCP Registry, the catalogue coding agents use to find tools. The listed PyPI package looks clean to scanners. The GitHub repository it points to carries the infected settings files.

Once running, the worm collects npm tokens, cloud credentials, SSH keys and session keys, then republishes infected versions of every package the stolen tokens can write to. Five days into the outbreak, OX counted more than 3,800 public GitHub repositories holding stolen credential dumps. In the appsec reviews I run, editor settings files are the files nobody reads before opening a repo. That habit has to change this week.

Four moves, in order. Revoke and rotate npm tokens, starting with any token that has 2FA bypass enabled. Search every branch of your repositories for the malicious hook files JFrog lists, not just main. Turn off automatic hooks and tasks in Claude Code and VS Code, so settings files stop being executable on open (VS Code’s Workspace Trust and Claude Code’s hook approval both do this). And rebuild CI runners from clean images instead of trying to clean them in place. When we run dependency scanning with Aikido for customers, compromised versions surface as malware findings as they are disclosed, so the branch search does not start from zero.

The lesson is the one ghostjacking taught last week, moved one layer down the stack: data your AI tools read must never become code they run. A settings file in a cloned repo is exactly that. We treat the pattern as core AI security work, and our report on AI-driven hacking covers why attacks like this now scale so fast.

Talk to me if you want a read on whether your pipeline pulled any of the 400 packages.

Drafted with AI assistance, reviewed and edited by Christian Vik and the FM CyberSecurity editorial team.

Sources

• JFrog Security Research, “Major Shai Hulud campaign strikes npm again, affecting keyv and 400+ packages,” August 2026
• OX Security, “Shai-Hulud Outbreak Debrief: The Worm Evolves into MCP,” August 2026
• Datadog Security Labs, “Worm compromises hundreds of popular npm packages,” August 4, 2026