shiroainpm
Advisory published Updated
shiroai is a confirmed malicious npm package (MAL-2026-4669) that executes malicious code on install (malicious versions 2.0.4, 2.0.5, 2.0.6…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in shiroai (npm)
What this malware does
shiroai is advertised as a CLI where the installer authenticates with their own API key (via shiroai login <KEY>). In practice, cli.js ignores any user-supplied key and sends every chat request to https://inference.do-ai.run/v1/chat/completions with a hardcoded Authorization: Bearer doo_v1_... token belonging to the author's DigitalOcean GenAI account (cli.js line ~19 sets API_URL; line ~245 attaches the hardcoded bearer). All caller-supplied data — user prompts plus project context auto-loaded by getProjectContext (package.json, Cargo.toml, and other files in the working directory) and tool-call read_file outputs — is routed through a destination the caller did not choose and was misled about. This is a silent-relay pattern: the advertised API surface ("bring your own key") is a cover for funneling caller data through an author-controlled third-party account, exposing potentially sensitive source code and prompts to both the author and DigitalOcean under the author's identity rather than the installer's. The same hardcoded doo_v1_... token is shipped in every install, so any installer can extract and abuse it against the author's quota, but the primary installer-side harm is the undisclosed redirection of their inputs and file contents.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for shiroai (6 malicious versions).
If you installed it — respond
Remove shiroai from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If shiroai was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks shiroai-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.