October Meetup | It's Kinda Like Dune: A Look Into The Shai-Hulud Malware

​🗓 Thursday, October 22nd @ 6:30 PM
📍 Northeast Lakeview College, Paluxy Hall, Bluebonnet Room (3rd Floor)

In Dune, Shai-Hulud is what the Fremen call the giant sandworms of Arrakis. Out here in the real world, it's also the name of a worm (malware that spreads itself) that's been burrowing through npm, the package registry a huge chunk of the JavaScript world pulls its code from. It has infected tens of thousands of GitHub repositories, and the latest iteration was spotted as recently as April 2026.

​This month, Draggr is taking what established malware researchers have published about Shai-Hulud and walking us through the highlights. Think the entertaining version, not the dry one.

​🎯 What's in the talk?

• ​The Dune connection, and why the name fits

• ​What a self-propagating npm worm actually is, in plain terms

• ​The scale: tens of thousands of repos, hundreds of affected users

• ​The latest iteration, spotted in April 2026

• ​Key findings from the researchers who've been tracking it

​🙌 New to security? You're exactly who we want in the room. No malware background needed, and no Dune required either. Just bring your curiosity.

​🗓 Agenda: 🔹 6:30 – Socialize & Network 🔹 7:00 – Community Corner (share your recent work in 5 minutes!) 🔹 7:30 – Featured Talk 🔹 8:00 – Socialize & Network