Prompt Injection in the Wild: npm Malware Weaponises AI Content Filters to Evade Analysis

Researchers at Socket published an analysis on 16 June 2026 of a malicious npm package, shai_hulululud@1.0.48596, that does something we had theorised but rarely observed in the wild: it actively attacks the analysis pipeline rather than simply hiding from it. Instead of evading signatures or sandboxes, the package is engineered to confuse, misdirect, and exhaust AI-assisted security tools before they reach the actual malicious code.

Four Layers of Adversarial Evasion

The package deploys four distinct techniques in sequence inside _index.js, each targeting a different weakness in AI-mediated code review:

1. 1Prompt injection. A block comment near the top of the file contains fake SYSTEM OVERRIDE instructions intended to hijack an LLM's analysis context — the same class of attack used against AI coding assistants, now repurposed against automated scanners.
2. 2Safety-trigger content. Subsequent comment blocks contain Japanese-language text describing biological weapon production. The intent is to activate AI content guardrails and provoke a refusal — leaving the real payload unexamined.
3. 3Token flooding. Lines 191 through 33,118 consist of approximately 32,000 lines of repeating identical comments. At roughly 3.5 million tokens, this wall is designed to exhaust the context window of any LLM-first scanner that processes the file verbatim.
4. 4Obfuscated JavaScript payload. After the comment sections, the actual executable code appears: a try{eval(…)} wrapper around character-code arrays, a ROT-style substitution function, and AES encryption layers. Strings extracted from the decoded payload reference credential theft, cryptocurrency platforms, browser data extraction, and callback infrastructure including Interactsh, Pipedream, and Burp Collaborator.

Socket's researchers classify the package as "protestware" — the decoded payload's callback infrastructure suggests demonstration rather than operational exfiltration. The technique, however, is entirely transferable to a functional infostealer or supply-chain implant.

Why This Is a Security Toolchain Problem, Not Just a Malware Problem

The attack surface here is not a vulnerability in the AI models themselves. It is a vulnerability in how AI is integrated into the analysis workflow: feeding raw, untrusted source files directly into an LLM without preprocessing. When the comment block is stripped and the executable AST is isolated before LLM analysis, none of the four techniques works. The prompt injection has no embedding, the safety triggers are gone, the token flood disappears, and the obfuscated payload is exposed on its own merits.

This mirrors a well-established principle in web security: never pass untrusted user input directly into an interpreter without sanitisation. The same discipline now applies to AI-mediated code review pipelines. An AI scanner that reads raw source is not reading code — it is reading attacker-controlled text that happens to contain code somewhere in it.

What Security Teams Should Take Away

• AI-assisted dependency scanning is an adversarial environment. Threat actors will increasingly probe for weaknesses in security tooling, not just in application code.
• Deterministic preprocessing is mandatory. Any pipeline that feeds raw source to an LLM should first strip comments, resolve imports, and parse the executable AST. The model then analyses code semantics, not attacker-supplied prose.
• Layered detection remains the standard. YARA rules, entropy analysis, and AST-based deobfuscation are unaffected by prompt injection or token flooding. They must run alongside — not be replaced by — LLM-based triage.
• Red-team your AI security tools. If your team is building or evaluating AI-assisted SAST or dependency review, test it against adversarial inputs: oversized files, injected instructions, and policy-triggering content in comments. These are table-stakes cases in 2026.

The Broader Signal

Prompt injection has matured from a research curiosity into operational technique. In 2024 and 2025 it appeared in phishing documents and malicious web content targeting AI coding assistants. This case extends the threat model to automated security infrastructure: CI/CD-integrated scanners, dependency review bots, and AI-powered SCA tooling. Any AI system that consumes untrusted content as part of a security decision is itself an attack surface — and should be red-teamed with exactly the adversarial creativity shown here.