A previously documented Shai-Hulud npm supply-chain worm payload has reportedly reappeared after 111 days of inactivity, using the exact same malicious file linked to the May 19 compromise of hundreds of @AntV package versions.
The reactivation raises concerns about registry-level malware detection because the payload’s SHA-256 hash had been publicly identified for months.
Researchers detected four npm packages published on September 7 that contained the same payload hash: e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6.
The packages were feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, and bmc-translate-utils@1.1.1.
The file had previously appeared in 319 package versions connected to the May @AntV campaign. No additional package carrying the hash was reportedly detected between May 20 and September 6, making the return a significant dormant-to-reactivation event.
Dormant npm Worm Returns
The renewed packages reportedly contained a root-level index.js file and a preinstall lifecycle hook that executed bun run index.js. This means the payload can run automatically when a developer or CI/CD system installs the affected dependency.
The earlier Shai-Hulud activity showed how attackers can weaponize compromised npm maintainer tokens.
After execution, the malware searches for credentials, including npm tokens, GitHub tokens, cloud credentials, SSH keys, Docker authentication data, and CI/CD secrets.
It can then validate stolen npm tokens, download package tarballs, inject its code, increase the version number, and republish the altered packages.
This propagation cycle turns the malware into a worm: every compromised maintainer account can provide access to more packages and victims.
The previous @AntV wave reportedly affected hundreds of package versions and used install-time execution to steal credentials, abuse GitHub accounts, and establish persistence through developer-tool configuration files.
The payload is also associated with the command-and-control domain t[.]m-kosche[.]com.
Earlier samples modified .vscode/tasks.json and .claude/settings.json, potentially allowing attackers to retain access even after victims remove the malicious dependency.
The campaign also created large numbers of rogue GitHub repositories using stolen tokens, often with Dune-themed names and reversed “Shai-Hulud” strings in repository descriptions. The notable issue is not a newly obfuscated or modified malware sample.
It is an identical payload with an already-known cryptographic hash. Hash-based detection is among the simplest controls available to malware-scanning systems because it does not require executing code, analyzing behavior, or unpacking complex obfuscation.
npm’s publish-time malware scanning is intended to inspect packages before they become available for installation.
However, the reported appearance of an unchanged, known-malicious file suggests that scanning controls may not consistently block every previously identified artifact, aikido said.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| SHA-256 hash | e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 | Identical malicious Shai-Hulud payload reused in the September npm package releases |
| C2 domain | t[.]m-kosche[.]com | Command-and-control infrastructure linked to the original May cam |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
