#malicious-package

shai_hulululud npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners

Socket identified shai_hulululud@1.0.48596 as a deliberately packed npm package that appears designed to probe or disrupt AI-assisted malware review with prompt-injection text, safety-triggering comments, context flooding, and obfuscated JavaScript.

Crypto Private Key Stealer Solana/Ethereum Typosquats

Socket disclosed five npm typosquats targeting Solana and Ethereum developers on 2026-03-24. Registry metadata shows malicious releases dating from 2025-11-18 through 2026-02-16; npm replaced four package records with security placeholders on 2026-04-01.