Ten Malicious npm Packages We Filed Are Still Installable. Mini Shai-Hulud Has Been Quiet for Ten Days.
Of the eleven npm packages we filed with OpenSSF's malicious-packages database this week, ten can still be installed this morning. Eight carry no warning at all. This is an update on the Apex Accelerator investigation, the two other campaigns in the same filings, and the Mini Shai-Hulud worm, which has not produced a new wave since October 8.
Apex Accelerator: the two older packages are still live
Elastic Security Labs exposed the Apex Accelerator operation (REF8801) on October 12, and npm deprecated its main package, @apexacc/cli, the next day. Yesterday we dated the operation back through two earlier packages under two other npm accounts.
Both are still live with no deprecation notice. @apexfdn/copilot-mcp is an MCP server whose "verify" gate hands the AI agent a shell command supplied by the operator's server. @apexscore/cli builds from the same GitHub repository as @apexacc/cli and downloads and runs a roughly 150 MB binary. Deprecation also does not stop installs: all 122 versions of @apexacc/cli still resolve, so a pinned version or an old lockfile keeps pulling it.
This morning we reported all three to npm security as malware, and for @apexacc/cli we asked that its versions be replaced with a security placeholder. We also posted the two older names on Elastic's REF8801 thread so the people already tracking the operation have them. The fourth Apex package, @apexacc/audit, is gone from the registry.
Two other campaigns in the same filings
imgdecode (MALFEX). Four versions published between September 30 and October 11 by an npm user whose name contains the campaign's own name. On require, it loads a prebuilt Windows native module that imports URL download, decryption and memory-protection functions, the shape of a download-decrypt-execute loader. Its exported function returns nothing, and the README documents a function that does not exist. Checkmarx and CloudSEK documented the MALFEX campaign; we matched this package to it from a static read, and we did not run the payload.
Six PhantomSub forks. OX Security documented PhantomSub on September 28: forks of Baileys, a popular WhatsApp Web library, that quietly subscribe the installer's own WhatsApp account to a channel the author chose. We read six forks still on npm and found the channel IDs and the automatic subscribe call in each. The largest, ourin-baileys, was downloaded 24,608 times in the month to October 16. Its harm is spam and audience-building rather than theft, but it acts on the user's authenticated account without consent.
Download counts include mirrors and automated installs, so they are an upper bound on people, not a count of victims. All eleven packages, including the removed one, are on our deny-list, and our check-package tool blocks every one. The OpenSSF pull requests (1644, 1645 and 1647) are open and not yet merged.
Mini Shai-Hulud: quiet since tensorlake
The last wave we can find is the tensorlake compromise on October 8, when one poisoned version of an AI-agent SDK stole AI-agent configuration files along with cloud and publishing tokens. Searches of vendor reporting this morning turned up nothing newer. Quiet is not over: the August keyv and cacheable wave came months after the May TanStack wave, from the same worm family.
The incident-response advice from that post still stands. This strain plants a watcher that wipes the home directory when the stolen GitHub token is revoked, so image the machine before you revoke anything. The command-and-control domain and the Ethereum contract the strain uses to hide its instructions have been in our feed since October 8, attributed to the analysts who found them.
One correction to our own tooling, found while checking it for this post. Our check-package tool blocks every version of tensorlake, including the clean 0.5.143 and 0.5.145. The cause is the OSV record: it lists only 0.5.144, but it also carries a version range with a start and no end, which by OSV's rules covers every version, and our check follows the range. The keyv, cacheable and TanStack records are bounded correctly, and our check clears their clean versions. We opened a pull request with OpenSSF to narrow the record to 0.5.144 (malicious-packages 1649). We also fixed our own check the same morning: it now blocks tensorlake 0.5.144 and returns review for 0.5.143 and 0.5.145. The fix covers this one record only, and it switches itself off if OSV changes the record. Open ranges on typosquat records still block every version, as they should.
What to do
Search your lockfiles for the eleven names in the table. Remove any you find, and rotate whatever credentials that machine held.
Do not treat "deprecated" as "removed". A deprecated npm version still installs.
If you build AI agents, treat any MCP tool that tells the agent to run a command from a server response as hostile, whatever the package code looks like.
We checked every status and download count in this post against the npm registry this morning. At least 5% of what remains is still wrong, and we don't know which.
If this was useful, or if it wasn't, rate it at the bottom of the page. It is the only direct signal we get.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=ten-malicious-npm-packages-we-filed-are-still-installable-mini-shai-hulud-has-been-quiet-for-ten-da
Comments