A newly published npm package, shai_hulululud@1.0.48596, appears designed to probe and disrupt AI-based malware scanners rather than steal credentials. The 9.28 MB index.js file combines three adversarial techniques: policy-triggering prompt content (including fake SYSTEM OVERRIDE instructions and weapons-themed text in Japanese) embedded in JavaScript comments, context flooding via tens of thousands of repeated comment lines pushing the total token count beyond 3.5 million, and obfuscated JavaScript appended at the end. The obfuscated payload uses AES encryption and ROT-style substitution, and once decoded re-introduces the same safety-triggering content — staging the attack both before and after deobfuscation. Socket classified the package as protestware rather than a credential stealer, but highlights it as a practical demonstration of LLM-specific denial-of-service patterns against AI-mediated package review. The research concludes that AI scanners need deterministic preprocessing, comment stripping, executable-path prioritization, and must fail closed on refusals or timeouts rather than treating them as clean results.
