shai_hulululud Targets AI Malware Scanners

This is less a sophisticated stealer than a proof-of-concept attack on the security scanner itself—and that distinction makes it important.

• –Comments are inert at runtime but become active attack input when passed directly to an LLM.
• –Safety refusals, token exhaustion, and truncated context can hide executable code without producing a false “clean” verdict.
• –Obfuscation and staged safety triggers make deeper automated analysis especially fragile.
• –Scanners should isolate comments, prioritize executable paths, combine LLMs with deterministic analysis, and fail closed on refusals or timeouts.
• –The package shows that AI analysis infrastructure is now part of the software supply-chain threat model.