Open Source · · 1 day

Squawk npm packages carried Shai-Hulud

JFrog listed 22 Squawk npm packages in the May 2026 Shai-Hulud wave. This record scopes those artifacts to their own official distribution surface.

Part of Shai-Hulud hits npm and PyPI campaign

Squawk was one of the broad package-family hits in the May 2026 Shai-Hulud wave. JFrog listed 22 affected @squawk/* npm packages and 110 affected versions, covering data, route, airport, airway, procedure, and utility modules under the same namespace.

That scale made Squawk more than a single bad tarball. A project using one aviation-data package could pull several related packages into the same lockfile or CI job, giving the TeamPCP payload repeated chances to execute in the same trusted environment. The worm's goal was not the package's business logic; it was the credentials and publishing authority around the install.

This record keeps the Squawk namespace separate from the aggregate campaign because responders need the full package family for inventory searches. The campaign page explains the common Shai-Hulud loader, credential theft, and self-propagation path; this page preserves the package names, version lists, registry URLs, and May 11-12 window.

Cleanup should treat the namespace as a cluster. Teams should search lockfiles, npm caches, artifact mirrors, and build logs for every listed @squawk/* release, then rotate credentials for any environment that installed them and review package publications made from those systems.

Notes

  • The network and payload indicators are the campaign-level set JFrog published for this wave, not observations of this package's own bytes. Indicators read from an acquired sample are marked as such where they appear.
  • Minimal campaign-linked record created to keep Shai-Hulud package evidence scoped by vendor, organization, maintainer account, or package distribution surface.
  • The sample manifest documents 19 complete synthetic tree reconstructions, including four generated-data releases closed with exact clean-predecessor dataset bytes. They stay named RECONSTRUCTED and are absent from artifact hashes.
  • Later affected releases whose router variants are unavailable remain explicitly RECONSTRUCTED-PARTIAL.

Appendix · Affected releases

110 samples linked above. Analysis and downloads are available in the lab. · 92 more could not be recovered

Indicators

  • file_sha256npm payload 29c729852fce5a53e30a1541d9fec79c915b2e13f1eda94a5978cf0aae0d88d9
  • file_sha256npm payload 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96
  • file_sha256npm payload ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
  • file_sha256npm payload d4a2086ea18f5e39cd867b8b06918a524eabb21d45ea98aad07357b98173458a
  • urlhttps://filev2.getsession.org/file/
  • domainseed1.getsession.org
  • domainseed2.getsession.org
  • domainseed3.getsession.org
  • domainapi.masscan.cloud
  • file~/.local/bin/gh-token-monitor.sh
  • file~/.config/systemd/user/gh-token-monitor.service
  • file~/Library/LaunchAgents/com.user.gh-token-monitor.plist
  • file~/.config/gh-token-monitor/
  • stringShai-Hulud: Here We Go Again
  • stringPUSH UR T3MPRR
  • stringFIRESCALE
  • commit_author[email protected]

References

  1. Shai-Hulud: Here We Go Again - Worm by TeamPCP Hits NPM and PyPIresearch.jfrog.com
  2. TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply Chain Attack - Socketsocket.dev
  3. Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack - Aikidoaikido.dev
  4. Socket file listing for @squawk/airport-data 0.7.8socket.dev
  5. Socket file listing for @squawk/airport-data 0.7.7socket.dev
  6. Socket file listing for @squawk/airport-data 0.7.6socket.dev
  7. Socket file listing for @squawk/airport-data 0.7.5socket.dev
  8. Socket file listing for @squawk/airport-data 0.7.4socket.dev
  9. Socket file listing for @squawk/airports 0.6.6socket.dev
  10. Socket file listing for @squawk/airports 0.6.5socket.dev
  11. Socket file listing for @squawk/airports 0.6.4socket.dev
  12. Socket file listing for @squawk/airports 0.6.3socket.dev
  13. Socket file listing for @squawk/airports 0.6.2socket.dev
  14. Socket file listing for @squawk/airspace 0.8.5socket.dev
  15. Socket file listing for @squawk/airspace 0.8.3socket.dev
  16. Socket file listing for @squawk/airspace 0.8.4socket.dev
  17. Socket file listing for @squawk/airspace 0.8.2socket.dev
  18. Socket file listing for @squawk/airspace 0.8.1socket.dev
  19. Socket file listing for @squawk/airspace-data 0.5.7socket.dev
  20. Socket file listing for @squawk/airspace-data 0.5.5socket.dev
  21. Socket file listing for @squawk/airspace-data 0.5.6socket.dev
  22. Socket file listing for @squawk/airspace-data 0.5.4socket.dev
  23. Socket file listing for @squawk/airspace-data 0.5.3socket.dev
  24. Socket file listing for @squawk/airway-data 0.5.8socket.dev
  25. Socket file listing for @squawk/airway-data 0.5.7socket.dev
  26. Socket file listing for @squawk/airway-data 0.5.6socket.dev
  27. Socket file listing for @squawk/airway-data 0.5.5socket.dev
  28. Socket file listing for @squawk/airway-data 0.5.4socket.dev
  29. Socket file listing for @squawk/airways 0.4.6socket.dev
  30. Socket file listing for @squawk/airways 0.4.4socket.dev
  31. Socket file listing for @squawk/airways 0.4.5socket.dev
  32. Socket file listing for @squawk/airways 0.4.3socket.dev
  33. Socket file listing for @squawk/airways 0.4.2socket.dev
  34. Socket file listing for @squawk/fix-data 0.6.8socket.dev
  35. Socket file listing for @squawk/fix-data 0.6.7socket.dev
  36. Socket file listing for @squawk/fix-data 0.6.6socket.dev
  37. Socket file listing for @squawk/fix-data 0.6.5socket.dev
  38. Socket file listing for @squawk/fix-data 0.6.4socket.dev
  39. Socket file listing for @squawk/fixes 0.3.6socket.dev
  40. Socket file listing for @squawk/fixes 0.3.5socket.dev
  41. Socket file listing for @squawk/fixes 0.3.4socket.dev
  42. Socket file listing for @squawk/fixes 0.3.3socket.dev
  43. Socket file listing for @squawk/fixes 0.3.2socket.dev
  44. Socket file listing for @squawk/flight-math 0.5.8socket.dev
  45. Socket file listing for @squawk/flight-math 0.5.7socket.dev
  46. Socket file listing for @squawk/flight-math 0.5.6socket.dev
  47. Socket file listing for @squawk/flight-math 0.5.5socket.dev
  48. Socket file listing for @squawk/flight-math 0.5.4socket.dev
  49. Socket file listing for @squawk/flightplan 0.5.6socket.dev
  50. Socket file listing for @squawk/flightplan 0.5.5socket.dev
  51. Socket file listing for @squawk/flightplan 0.5.4socket.dev
  52. Socket file listing for @squawk/flightplan 0.5.3socket.dev
  53. Socket file listing for @squawk/flightplan 0.5.2socket.dev
  54. Socket file listing for @squawk/geo 0.4.8socket.dev
  55. Socket file listing for @squawk/geo 0.4.7socket.dev
  56. Socket file listing for @squawk/geo 0.4.6socket.dev
  57. Socket file listing for @squawk/geo 0.4.5socket.dev
  58. Socket file listing for @squawk/geo 0.4.4socket.dev
  59. Socket file listing for @squawk/icao-registry 0.5.6socket.dev
  60. Socket file listing for @squawk/icao-registry 0.5.5socket.dev
  61. Socket file listing for @squawk/icao-registry 0.5.4socket.dev
  62. Socket file listing for @squawk/icao-registry 0.5.3socket.dev
  63. Socket file listing for @squawk/icao-registry 0.5.2socket.dev
  64. Socket file listing for @squawk/icao-registry-data 0.8.8socket.dev
  65. Socket file listing for @squawk/icao-registry-data 0.8.6socket.dev
  66. Socket file listing for @squawk/icao-registry-data 0.8.7socket.dev
  67. Socket file listing for @squawk/icao-registry-data 0.8.5socket.dev
  68. Socket file listing for @squawk/icao-registry-data 0.8.4socket.dev
  69. Socket file listing for @squawk/mcp 0.9.5socket.dev
  70. Socket file listing for @squawk/mcp 0.9.4socket.dev
  71. Socket file listing for @squawk/mcp 0.9.3socket.dev
  72. Socket file listing for @squawk/mcp 0.9.2socket.dev
  73. Socket file listing for @squawk/mcp 0.9.1socket.dev
  74. Socket file listing for @squawk/navaid-data 0.6.8socket.dev
  75. Socket file listing for @squawk/navaid-data 0.6.7socket.dev
  76. Socket file listing for @squawk/navaid-data 0.6.6socket.dev
  77. Socket file listing for @squawk/navaid-data 0.6.5socket.dev
  78. Socket file listing for @squawk/navaid-data 0.6.4socket.dev
  79. Socket file listing for @squawk/navaids 0.4.6socket.dev
  80. Socket file listing for @squawk/navaids 0.4.5socket.dev
  81. Socket file listing for @squawk/navaids 0.4.4socket.dev
  82. Socket file listing for @squawk/navaids 0.4.3socket.dev
  83. Socket file listing for @squawk/navaids 0.4.2socket.dev
  84. Socket file listing for @squawk/notams 0.3.10socket.dev
  85. Socket file listing for @squawk/notams 0.3.9socket.dev
  86. Socket file listing for @squawk/notams 0.3.8socket.dev
  87. Socket file listing for @squawk/notams 0.3.7socket.dev
  88. Socket file listing for @squawk/notams 0.3.6socket.dev
  89. Socket file listing for @squawk/procedure-data 0.7.7socket.dev
  90. Socket file listing for @squawk/procedure-data 0.7.5socket.dev
  91. Socket file listing for @squawk/procedure-data 0.7.6socket.dev
  92. Socket file listing for @squawk/procedure-data 0.7.4socket.dev
  93. Socket file listing for @squawk/procedure-data 0.7.3socket.dev
  94. Socket file listing for @squawk/procedures 0.5.6socket.dev
  95. Socket file listing for @squawk/procedures 0.5.4socket.dev
  96. Socket file listing for @squawk/procedures 0.5.5socket.dev
  97. Socket file listing for @squawk/procedures 0.5.3socket.dev
  98. Socket file listing for @squawk/procedures 0.5.2socket.dev
  99. Socket file listing for @squawk/types 0.8.5socket.dev
  100. Socket file listing for @squawk/types 0.8.3socket.dev
  101. Socket file listing for @squawk/types 0.8.4socket.dev
  102. Socket file listing for @squawk/types 0.8.2socket.dev
  103. Socket file listing for @squawk/types 0.8.1socket.dev
  104. Socket file listing for @squawk/units 0.4.7socket.dev
  105. Socket file listing for @squawk/units 0.4.5socket.dev
  106. Socket file listing for @squawk/units 0.4.6socket.dev
  107. Socket file listing for @squawk/units 0.4.4socket.dev
  108. Socket file listing for @squawk/units 0.4.3socket.dev
  109. Socket file listing for @squawk/weather 0.5.10socket.dev
  110. Socket file listing for @squawk/weather 0.5.8socket.dev
  111. Socket file listing for @squawk/weather 0.5.9socket.dev
  112. Socket file listing for @squawk/weather 0.5.7socket.dev
  113. Socket file listing for @squawk/weather 0.5.6socket.dev
  114. Clean predecessor Socket file listing for @squawk/airport-data 0.7.3socket.dev
  115. Clean predecessor jsDelivr manifest for @squawk/airport-data 0.7.3data.jsdelivr.com
  116. Clean predecessor Socket file listing for @squawk/airspace-data 0.5.2socket.dev
  117. Clean predecessor jsDelivr manifest for @squawk/airspace-data 0.5.2data.jsdelivr.com
  118. Clean predecessor Socket file listing for @squawk/airway-data 0.5.3socket.dev
  119. Clean predecessor jsDelivr manifest for @squawk/airway-data 0.5.3data.jsdelivr.com
  120. Clean predecessor Socket file listing for @squawk/fix-data 0.6.3socket.dev
  121. Clean predecessor jsDelivr manifest for @squawk/fix-data 0.6.3data.jsdelivr.com
  122. npm registry metadata for clean @squawk/airport-data 0.7.3registry.npmjs.org
  123. npm registry metadata for clean @squawk/airspace-data 0.5.2registry.npmjs.org
  124. npm registry metadata for clean @squawk/airway-data 0.5.3registry.npmjs.org
  125. npm registry metadata for clean @squawk/fix-data 0.6.3registry.npmjs.org

Source record: oss/attacks/shai-hulud-squawk-npm/meta.yaml