Socket: npm Package Uses Prompt Injection + Token Flooding to Evade AI Malware Scanners

What it is

shai_hulululud@1.0.48596, an npm package with a ~9.28 MB index.js engineered to attack AI-based malware scanners rather than the running system. Socket classifies it as "Protestware or potentially unwanted behavior," not credential-stealing malware — it appears to be a probe testing how AI review pipelines handle hostile source text.

How it works

Three layers, all inert to a JavaScript parser but active against an LLM reading source as text:

• A Japanese-language block comment posing as biological-weapon instructions, meant to trip safety guardrails.
• A fake system-override prompt-injection block aimed at the reviewing model's instruction hierarchy.
• Tens of thousands of identical repeated comment lines — Socket observed these from approximately line 191 to line 33118 — pushing the file past 3.5 million tokens, well beyond current frontier context windows.
• Obfuscated JavaScript (the actual payload location) appended at the very end, after all the noise.

The design assumes the scanner reaches the safety/injection content first and the real code last.

What to do

The page states no patch or command — the actionable content is design guidance for anyone running LLM-assisted dependency or code scanning. The named failure modes to defend against:

• Model refuses analysis on seeing prohibited-weapons content.
• Model follows fake system instructions embedded in comments.
• Scanner errors/times out before reaching executable code.
• Analysis dominated by comment content instead of package behavior.
• File truncated before the appended obfuscated payload.

Implied mitigations from the text: treat source-code comments as untrusted data, not instructions; do not naively submit whole files; chunk in a way that prioritizes executable code over comment-heavy sections; and ensure the pipeline fails closed rather than open when it refuses or truncates.

flowchart TD
    A[LLM scanner ingests index.js] --> B{Reaches payload?}
    B -->|Refuses / truncates / times out| C[Fails open: package passes]
    B -->|Prioritizes executable code| D[Obfuscated JS at file end reviewed]
    S[Comments treated as untrusted data] --> D

Caveats

• This is not the credential-stealing payload seen in the related Mini Shai-Hulud, Miasma, and Hades campaigns; it is protestware/PUA, so the direct risk is to your scanning pipeline's reliability, not to secrets.
• The weapon-instruction and repeated-comment content's "accuracy" is irrelevant — Socket stresses placement and purpose, not feasibility.
• The page's redacted excerpts mean you cannot reproduce the exact injection strings from it; treat the described failure modes, not specific strings, as the test cases.