Reported by 2 outlets

Timeline

1. original reporting

   npm Supply Chain Worm Returns After Four-Month Dormancy With Same Malicious Payload

   cyberpress.org · 35d ago · September 8th, 2026

   A previously documented Shai-Hulud npm supply-chain worm payload has reportedly reappeared after 111 days of inactivity, using the exact same malicious file linked to the May 19 compromise of hundreds of @AntV package versions. The reactivation raises concerns about registry-level malware detection because the payload’s SHA-256 hash had been publicly identified for months. Researchers detected four npm packages published on September 7 that contained the same payload hash: e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 . The packages were feishu-docx-mcp@0.3.2 , bmc-i18n-extract-cli@1.1.1 , blueai-cli@0.7.0 , and bmc-translate-utils@1.1.1 . The file had previously appeared in 319 package versions connected to the May @AntV campaign. No additional package carrying the hash was reportedly detected between May 20 and September 6, making the return a significant dormant-to-reactivation event. Dormant npm Worm Returns The renewed packages reportedly contained a root-level index.js file and a preinstall lifecycle hook that executed bun run index.js . This means the payload can run automatically when a developer or CI/CD system installs the affected dependency. The earlier Shai-Hulud activity showed how attackers can weaponize compromised npm maintainer tokens. After execution, the malware searches for credentials, including npm tokens, GitHub tokens , cloud credentials, SSH keys, Docker authentication data, and CI/CD secrets. It can then validate stolen npm tokens

2. update from gbhackers.com

   Known npm Worm Returns After 111 Days and Security Scanning Still Let It Through

   gbhackers.com · 35d ago · September 8th, 2026

   A known Shai-Hulud npm worm payload has resurfaced after 111 days of inactivity, raising fresh questions about the effectiveness of registry-level malware screening. The May campaign demonstrated how quickly a single compromised maintainer account can turn into a software supply-chain incident. Attackers pushed malicious versions across npm packages, including widely used visualization and frontend dependencies. […] The post Known npm Worm Returns After 111 Days and Security Scanning Still Let It Through appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .