Python Mini Shai-Hulud worm

A new worm has been discovered in a large number of python packages. If you have downloaded packages or used AI for coding the last couple of days, you need to check your machine.

Tiago has checked the institute mamba environment, and it is not affected. Check your home directory and other directories where you have python packages installed, on the workstation and your laptop.

By Torben Leifsen

Published May 12, 2026

About the worm:

https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem

Scan to check if you are affected:

git clone https://github.com/orjahren/mini-shai-hulud

Then run the pc-checker script

By default your home directory is checked. If you need to scan other directories, it is easy to adapt the script.

If you find that you are compromised:

Don´t try to clean up yourself.

Contact https://www.uio.no/tjenester/it/sikkerhet/cert/

They will help.

Published May 12, 2026 4:57 PM - Last modified May 12, 2026 4:57 PM