Open Source · · 1 day

Squawk npm packages carried Shai-Hulud

JFrog listed 22 Squawk npm packages in the May 2026 Shai-Hulud wave. This record scopes those artifacts to their own official distribution surface.

Part of Shai-Hulud hits npm and PyPI campaign

Squawk was one of the broad package-family hits in the May 2026 Shai-Hulud wave. JFrog listed 22 affected @squawk/* npm packages and 110 affected versions, covering data, route, airport, airway, procedure, and utility modules under the same namespace.

That scale made Squawk more than a single bad tarball. A project using one aviation-data package could pull several related packages into the same lockfile or CI job, giving the TeamPCP payload repeated chances to execute in the same trusted environment. The worm's goal was not the package's business logic; it was the credentials and publishing authority around the install.

This record keeps the Squawk namespace separate from the aggregate campaign because responders need the full package family for inventory searches. The campaign page explains the common Shai-Hulud loader, credential theft, and self-propagation path; this page preserves the package names, version lists, registry URLs, and May 11-12 window.

Cleanup should treat the namespace as a cluster. Teams should search lockfiles, npm caches, artifact mirrors, and build logs for every listed @squawk/* release, then rotate credentials for any environment that installed them and review package publications made from those systems.

Notes

  • The network and payload indicators are the campaign-level set JFrog published for this wave, not observations of this package's own bytes. Indicators read from an acquired sample are marked as such where they appear.
  • Minimal campaign-linked record created to keep Shai-Hulud package evidence scoped by vendor, organization, maintainer account, or package distribution surface.
  • The sample manifest documents 19 complete synthetic tree reconstructions, including four generated-data releases closed with exact clean-predecessor dataset bytes. They stay named RECONSTRUCTED and are absent from artifact hashes.
  • Later affected releases whose router variants are unavailable remain explicitly RECONSTRUCTED-PARTIAL.

Appendix · Affected releases

@squawk/airport-data npm
0.7.8 sha256 869f773a…8942db2a download unavailable
0.7.7 sha256 7275113a…9dc8bca6 download unavailable
0.7.6 sha256 9b240f6b…442d3f41 download unavailable
0.7.5 sha256 b28a8051…a7a9bac6 download unavailable
0.7.4 sha256 3d0be1bf…fdfd9376 download unavailable
@squawk/airports npm
0.6.6 sha256 0e04ee3e…3fb37ebd download unavailable
0.6.5 sha256 4db67084…fbbde27e download unavailable
0.6.4 sha256 1297c738…237c061a download unavailable
0.6.3 sha256 fef6822c…5e714830 download unavailable
0.6.2 sha256 11662eb9…efb01b98 download unavailable
@squawk/airspace npm
0.8.5 sha256 a24eb50d…98244462 download unavailable
0.8.3 sha256 1c18e924…6d9a8a8e download unavailable
0.8.4 sha256 9e3747c9…6a3c9481 download unavailable
0.8.2 sha256 05fd2181…744e149f download unavailable
0.8.1 sha256 fb36078e…c93ab271 download unavailable
@squawk/airspace-data npm
0.5.7 sha256 8ea30bc6…a946f784 download unavailable
0.5.5 sha256 dd608b49…c035ed40 download unavailable
0.5.6 sha256 545405e4…23aaec60 download unavailable
0.5.4 sha256 91f2349a…21200566 download unavailable
0.5.3 sha256 b478df3e…5c36a739 download unavailable
@squawk/airway-data npm
0.5.8 sha256 e37d63ea…883769ea download unavailable
0.5.7 sha256 676a0d7e…c4363925 download unavailable
0.5.6 sha256 7cb51363…5034c630 download unavailable
0.5.5 sha256 9c6c3963…22c79456 download unavailable
0.5.4 sha256 d58fa803…d67652f3 download unavailable
@squawk/airways npm
0.4.6 sha256 833e6e93…1c4ac50f download unavailable
0.4.4 sha256 b7017527…5b16bcd7 download unavailable
0.4.5 sha256 ea0b13ab…84053ace download unavailable
0.4.3 sha256 1c95c4f3…48902fb6 download unavailable
0.4.2 sha256 abec4648…867b689a download unavailable
@squawk/fix-data npm
0.6.8 sha256 ef10e00f…d3fa4d84 download unavailable
0.6.7 sha256 8f478424…86779eec download unavailable
0.6.6 sha256 b42e01b6…10700990 download unavailable
0.6.5 sha256 ec1388d3…a57fbd7e download unavailable
0.6.4 sha256 7299d2ec…12955fd1 download unavailable
@squawk/fixes npm
0.3.6 sha256 5b0ce66f…6104a452 download unavailable
0.3.5 sha256 54a991d1…254e566e download unavailable
0.3.4 sha256 2a85f643…4400a5c7 download unavailable
0.3.3 sha256 b8547288…57385ce8 download unavailable
0.3.2 sha256 4e454381…cece0470 download unavailable
@squawk/flight-math npm
0.5.8 sha256 9be779cf…f2f0305d download unavailable
0.5.7 sha256 f93844fd…5baf410c download unavailable
0.5.6 sha256 810e4a8a…91198b78 download unavailable
0.5.5 sha256 e5804267…66ede256 download unavailable
0.5.4 sha256 3689e926…fe7356e5 download unavailable
@squawk/flightplan npm
0.5.6 sha256 79d84ae0…7e2d83a6 download unavailable
0.5.5 sha256 5cd45882…148a834c download unavailable
0.5.4 sha256 f49c7d1e…d4709bd4 download unavailable
0.5.3 sha256 61a45b87…ca06a90c download unavailable
0.5.2 sha256 cbe7b318…0c64114d download unavailable
@squawk/geo npm
0.4.8 sha256 ed10893e…a5f9d3ee download unavailable
0.4.7 sha256 76a67dbd…7216373e download unavailable
0.4.6 sha256 d342d093…644d9f1f download unavailable
0.4.5 sha256 09a18631…06f07d4a download unavailable
0.4.4 sha256 7107e33f…73ccbf52 download unavailable
@squawk/icao-registry npm
0.5.6 sha256 0f1673ca…905d8e9f download unavailable
0.5.5 sha256 8f5a42dc…1e5dba1b download unavailable
0.5.4 sha256 33c471a6…61b377d1 download unavailable
0.5.3 sha256 af529d58…9a080c27 download unavailable
0.5.2 sha256 a2c2fce3…a4693dde download unavailable
@squawk/icao-registry-data npm
0.8.8 sha256 ff7502a5…d50a3629 download unavailable
0.8.6 sha256 bb358e61…0c385794 download unavailable
0.8.7 sha256 9092cdaa…5a8b5906 download unavailable
0.8.5 sha256 edbdbf50…069d0b6c download unavailable
0.8.4 sha256 da67a722…7419a1cd download unavailable
@squawk/mcp npm
0.9.5 sha256 fe18a8cd…153a8c49 download unavailable
0.9.4 sha256 3843a902…18d8ec0a download unavailable
0.9.3 sha256 96b78591…38f294a6 download unavailable
0.9.2 sha256 969a31ce…124861ac download unavailable
0.9.1 sha256 c479053e…76cc0c45 download unavailable
@squawk/navaid-data npm
0.6.8 sha256 e905f0cf…36bdee19 download unavailable
0.6.7 sha256 edd2ec3a…7783bdb6 download unavailable
0.6.6 sha256 7a0cb005…4a052986 download unavailable
0.6.5 sha256 994259ae…68f59a35 download unavailable
0.6.4 sha256 a9457834…ccf2f985 download unavailable
@squawk/navaids npm
0.4.6 sha256 917b9e6a…49a05961 download unavailable
0.4.5 sha256 86a970de…00eb43a1 download unavailable
0.4.4 sha256 394ee077…74dabd99 download unavailable
0.4.3 sha256 cb7dea23…d8ca4f7f download unavailable
0.4.2 sha256 785c92e8…7733ed60 download unavailable
@squawk/notams npm
0.3.10 sha256 007d8d46…59f82cd3 download unavailable
0.3.9 sha256 d1b02651…95f62986 download unavailable
0.3.8 sha256 511d8c11…bbbe74b5 download unavailable
0.3.7 sha256 e79f0ac7…443da52d download unavailable
0.3.6 sha256 16725743…7d44dfdf download unavailable
@squawk/procedure-data npm
0.7.7 sha256 c485ef35…6821d325 download unavailable
0.7.5 sha256 0e82d088…358f7053 download unavailable
0.7.6 sha256 7fe9a841…3d098f59 download unavailable
0.7.4 sha256 549c34f2…f51c670c download unavailable
0.7.3 sha256 819d75c6…e3016c74 download unavailable
@squawk/procedures npm
0.5.6 sha256 b225748e…efc7ba81 download unavailable
0.5.4 sha256 ce228b8f…fb94fbbd download unavailable
0.5.5 sha256 e50bd317…722b85ca download unavailable
0.5.3 sha256 c8ad0bc7…1ba6764d download unavailable
0.5.2 sha256 d4c50b77…93e2b0cb download unavailable
@squawk/types npm
0.8.5 sha256 514a3999…f2bfd5f7 download unavailable
0.8.3 sha256 c838bfc3…425a31c3 download unavailable
0.8.4 sha256 5916ac65…ef0cb883 download unavailable
0.8.2 sha256 5e12f8de…b5396781 download unavailable
0.8.1 sha256 1835a98b…696a2b17 download unavailable
@squawk/units npm
0.4.7 sha256 9ae73954…46dce713 download unavailable
0.4.5 sha256 0836b61d…56f7a0e6 download unavailable
0.4.6 sha256 9b053377…df7dc5ea download unavailable
0.4.4 sha256 65177825…22954037 download unavailable
0.4.3 sha256 1a910661…ccb6f273 download unavailable
@squawk/weather npm
0.5.10 sha256 19fe4de7…525aabfa download unavailable
0.5.8 sha256 246deff5…1049bd5b download unavailable
0.5.9 sha256 813428af…f266f8e6 download unavailable
0.5.7 sha256 910a7a89…6e3fad7b download unavailable
0.5.6 sha256 88802b29…a6b210ae download unavailable

Indicators

  • file_sha256npm payload 29c729852fce5a53e30a1541d9fec79c915b2e13f1eda94a5978cf0aae0d88d9
  • file_sha256npm payload 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96
  • file_sha256npm payload ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
  • file_sha256npm payload d4a2086ea18f5e39cd867b8b06918a524eabb21d45ea98aad07357b98173458a
  • urlhttps://filev2.getsession.org/file/
  • domainseed1.getsession.org
  • domainseed2.getsession.org
  • domainseed3.getsession.org
  • domainapi.masscan.cloud
  • file~/.local/bin/gh-token-monitor.sh
  • file~/.config/systemd/user/gh-token-monitor.service
  • file~/Library/LaunchAgents/com.user.gh-token-monitor.plist
  • file~/.config/gh-token-monitor/
  • stringShai-Hulud: Here We Go Again
  • stringPUSH UR T3MPRR
  • stringFIRESCALE
  • commit_author[email protected]

References

  1. Shai-Hulud: Here We Go Again - Worm by TeamPCP Hits NPM and PyPIresearch.jfrog.com
  2. TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply Chain Attack - Socketsocket.dev
  3. Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack - Aikidoaikido.dev
  4. Socket file listing for @squawk/airport-data 0.7.8socket.dev
  5. Socket file listing for @squawk/airport-data 0.7.7socket.dev
  6. Socket file listing for @squawk/airport-data 0.7.6socket.dev
  7. Socket file listing for @squawk/airport-data 0.7.5socket.dev
  8. Socket file listing for @squawk/airport-data 0.7.4socket.dev
  9. Socket file listing for @squawk/airports 0.6.6socket.dev
  10. Socket file listing for @squawk/airports 0.6.5socket.dev
  11. Socket file listing for @squawk/airports 0.6.4socket.dev
  12. Socket file listing for @squawk/airports 0.6.3socket.dev
  13. Socket file listing for @squawk/airports 0.6.2socket.dev
  14. Socket file listing for @squawk/airspace 0.8.5socket.dev
  15. Socket file listing for @squawk/airspace 0.8.3socket.dev
  16. Socket file listing for @squawk/airspace 0.8.4socket.dev
  17. Socket file listing for @squawk/airspace 0.8.2socket.dev
  18. Socket file listing for @squawk/airspace 0.8.1socket.dev
  19. Socket file listing for @squawk/airspace-data 0.5.7socket.dev
  20. Socket file listing for @squawk/airspace-data 0.5.5socket.dev
  21. Socket file listing for @squawk/airspace-data 0.5.6socket.dev
  22. Socket file listing for @squawk/airspace-data 0.5.4socket.dev
  23. Socket file listing for @squawk/airspace-data 0.5.3socket.dev
  24. Socket file listing for @squawk/airway-data 0.5.8socket.dev
  25. Socket file listing for @squawk/airway-data 0.5.7socket.dev
  26. Socket file listing for @squawk/airway-data 0.5.6socket.dev
  27. Socket file listing for @squawk/airway-data 0.5.5socket.dev
  28. Socket file listing for @squawk/airway-data 0.5.4socket.dev
  29. Socket file listing for @squawk/airways 0.4.6socket.dev
  30. Socket file listing for @squawk/airways 0.4.4socket.dev
  31. Socket file listing for @squawk/airways 0.4.5socket.dev
  32. Socket file listing for @squawk/airways 0.4.3socket.dev
  33. Socket file listing for @squawk/airways 0.4.2socket.dev
  34. Socket file listing for @squawk/fix-data 0.6.8socket.dev
  35. Socket file listing for @squawk/fix-data 0.6.7socket.dev
  36. Socket file listing for @squawk/fix-data 0.6.6socket.dev
  37. Socket file listing for @squawk/fix-data 0.6.5socket.dev
  38. Socket file listing for @squawk/fix-data 0.6.4socket.dev
  39. Socket file listing for @squawk/fixes 0.3.6socket.dev
  40. Socket file listing for @squawk/fixes 0.3.5socket.dev
  41. Socket file listing for @squawk/fixes 0.3.4socket.dev
  42. Socket file listing for @squawk/fixes 0.3.3socket.dev
  43. Socket file listing for @squawk/fixes 0.3.2socket.dev
  44. Socket file listing for @squawk/flight-math 0.5.8socket.dev
  45. Socket file listing for @squawk/flight-math 0.5.7socket.dev
  46. Socket file listing for @squawk/flight-math 0.5.6socket.dev
  47. Socket file listing for @squawk/flight-math 0.5.5socket.dev
  48. Socket file listing for @squawk/flight-math 0.5.4socket.dev
  49. Socket file listing for @squawk/flightplan 0.5.6socket.dev
  50. Socket file listing for @squawk/flightplan 0.5.5socket.dev
  51. Socket file listing for @squawk/flightplan 0.5.4socket.dev
  52. Socket file listing for @squawk/flightplan 0.5.3socket.dev
  53. Socket file listing for @squawk/flightplan 0.5.2socket.dev
  54. Socket file listing for @squawk/geo 0.4.8socket.dev
  55. Socket file listing for @squawk/geo 0.4.7socket.dev
  56. Socket file listing for @squawk/geo 0.4.6socket.dev
  57. Socket file listing for @squawk/geo 0.4.5socket.dev
  58. Socket file listing for @squawk/geo 0.4.4socket.dev
  59. Socket file listing for @squawk/icao-registry 0.5.6socket.dev
  60. Socket file listing for @squawk/icao-registry 0.5.5socket.dev
  61. Socket file listing for @squawk/icao-registry 0.5.4socket.dev
  62. Socket file listing for @squawk/icao-registry 0.5.3socket.dev
  63. Socket file listing for @squawk/icao-registry 0.5.2socket.dev
  64. Socket file listing for @squawk/icao-registry-data 0.8.8socket.dev
  65. Socket file listing for @squawk/icao-registry-data 0.8.6socket.dev
  66. Socket file listing for @squawk/icao-registry-data 0.8.7socket.dev
  67. Socket file listing for @squawk/icao-registry-data 0.8.5socket.dev
  68. Socket file listing for @squawk/icao-registry-data 0.8.4socket.dev
  69. Socket file listing for @squawk/mcp 0.9.5socket.dev
  70. Socket file listing for @squawk/mcp 0.9.4socket.dev
  71. Socket file listing for @squawk/mcp 0.9.3socket.dev
  72. Socket file listing for @squawk/mcp 0.9.2socket.dev
  73. Socket file listing for @squawk/mcp 0.9.1socket.dev
  74. Socket file listing for @squawk/navaid-data 0.6.8socket.dev
  75. Socket file listing for @squawk/navaid-data 0.6.7socket.dev
  76. Socket file listing for @squawk/navaid-data 0.6.6socket.dev
  77. Socket file listing for @squawk/navaid-data 0.6.5socket.dev
  78. Socket file listing for @squawk/navaid-data 0.6.4socket.dev
  79. Socket file listing for @squawk/navaids 0.4.6socket.dev
  80. Socket file listing for @squawk/navaids 0.4.5socket.dev
  81. Socket file listing for @squawk/navaids 0.4.4socket.dev
  82. Socket file listing for @squawk/navaids 0.4.3socket.dev
  83. Socket file listing for @squawk/navaids 0.4.2socket.dev
  84. Socket file listing for @squawk/notams 0.3.10socket.dev
  85. Socket file listing for @squawk/notams 0.3.9socket.dev
  86. Socket file listing for @squawk/notams 0.3.8socket.dev
  87. Socket file listing for @squawk/notams 0.3.7socket.dev
  88. Socket file listing for @squawk/notams 0.3.6socket.dev
  89. Socket file listing for @squawk/procedure-data 0.7.7socket.dev
  90. Socket file listing for @squawk/procedure-data 0.7.5socket.dev
  91. Socket file listing for @squawk/procedure-data 0.7.6socket.dev
  92. Socket file listing for @squawk/procedure-data 0.7.4socket.dev
  93. Socket file listing for @squawk/procedure-data 0.7.3socket.dev
  94. Socket file listing for @squawk/procedures 0.5.6socket.dev
  95. Socket file listing for @squawk/procedures 0.5.4socket.dev
  96. Socket file listing for @squawk/procedures 0.5.5socket.dev
  97. Socket file listing for @squawk/procedures 0.5.3socket.dev
  98. Socket file listing for @squawk/procedures 0.5.2socket.dev
  99. Socket file listing for @squawk/types 0.8.5socket.dev
  100. Socket file listing for @squawk/types 0.8.3socket.dev
  101. Socket file listing for @squawk/types 0.8.4socket.dev
  102. Socket file listing for @squawk/types 0.8.2socket.dev
  103. Socket file listing for @squawk/types 0.8.1socket.dev
  104. Socket file listing for @squawk/units 0.4.7socket.dev
  105. Socket file listing for @squawk/units 0.4.5socket.dev
  106. Socket file listing for @squawk/units 0.4.6socket.dev
  107. Socket file listing for @squawk/units 0.4.4socket.dev
  108. Socket file listing for @squawk/units 0.4.3socket.dev
  109. Socket file listing for @squawk/weather 0.5.10socket.dev
  110. Socket file listing for @squawk/weather 0.5.8socket.dev
  111. Socket file listing for @squawk/weather 0.5.9socket.dev
  112. Socket file listing for @squawk/weather 0.5.7socket.dev
  113. Socket file listing for @squawk/weather 0.5.6socket.dev
  114. Clean predecessor Socket file listing for @squawk/airport-data 0.7.3socket.dev
  115. Clean predecessor jsDelivr manifest for @squawk/airport-data 0.7.3data.jsdelivr.com
  116. Clean predecessor Socket file listing for @squawk/airspace-data 0.5.2socket.dev
  117. Clean predecessor jsDelivr manifest for @squawk/airspace-data 0.5.2data.jsdelivr.com
  118. Clean predecessor Socket file listing for @squawk/airway-data 0.5.3socket.dev
  119. Clean predecessor jsDelivr manifest for @squawk/airway-data 0.5.3data.jsdelivr.com
  120. Clean predecessor Socket file listing for @squawk/fix-data 0.6.3socket.dev
  121. Clean predecessor jsDelivr manifest for @squawk/fix-data 0.6.3data.jsdelivr.com
  122. npm registry metadata for clean @squawk/airport-data 0.7.3registry.npmjs.org
  123. npm registry metadata for clean @squawk/airspace-data 0.5.2registry.npmjs.org
  124. npm registry metadata for clean @squawk/airway-data 0.5.3registry.npmjs.org
  125. npm registry metadata for clean @squawk/fix-data 0.6.3registry.npmjs.org

Source record: oss/attacks/shai-hulud-squawk-npm/meta.yaml