Shai-Hulud Payload Returns to npm After 111 Days

A file carrying the exact payload hash from May's Shai-Hulud worm attack on npm reappeared in four unrelated packages on Sept. 7, 111 days after it was last seen, Aikido Security researcher Charlie Eriksen wrote in a report published the same day.

What came back, and in what

The SHA256 hash e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 first appeared in 319 package versions on May 19, part of a wider wave that pushed 639 malicious versions of @antv-scoped packages to npm within a single hour, Eriksen wrote. After that day, he said, there were "zero new hits on this hash between May 20 and September 6." On Sept. 7, the identical hash resurfaced in four package versions unrelated to the original @antv packages, all published within the same hour from a single account: feishu-docx-mcp 0.3.2, bmc-i18n-extract-cli 1.1.1, blueai-cli 0.7.0 and bmc-translate-utils 1.1.1.

What the payload does

The file runs a fixed sequence once it lands, according to Eriksen's report: outbound validation calls against the npm registry using stolen publish tokens, a tarball download and payload-injection step, a version bump and republish cycle to spread to other packages, and mass creation of GitHub repositories to stage stolen data.

npm's new scanner did not catch a known hash

npm introduced publish-time malware scanning in July, holding new packages for five to fifteen minutes for automated checks before they go live, IT Pro reported. The four September packages cleared that window despite carrying a hash npm's own ecosystem had already flagged as malicious in May. "Signature matching against known-malicious artifacts is the single easiest bar to clear in this industry," Eriksen told IT Pro. IT Pro said it approached npm for comment but had not received a response by the time of publication.

	May 19 wave	Sept. 7 reactivation
Packages published	639 versions, @antv scope	4 versions, unrelated packages
Versions carrying this exact hash	319	4
npm publish-time scanner in place	No	Yes, 5-15 minute hold

The group behind the original wave has already been charged

Australian Federal Police, working with the FBI and Western Australia Police, arrested two men in Western Australia on Aug. 26 over their alleged roles in TeamPCP, the group blamed for the broader Shai-Hulud campaign, according to Help Net Security. A 21-year-old from Cottesloe faces eight charges, including unauthorized data modification and dealing with proceeds of crime worth more than $100,000, and a 23-year-old from Mandurah faces six related charges. Authorities said the wider campaign stole more than 500,000 credentials and at least 300 gigabytes of data from more than 1,000 organizations. The FBI said in a statement that the men "are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide."

The arrests came 12 days before the identical payload hash resurfaced on npm. Eriksen's report does not say whether the Sept. 7 account is linked to the two men now facing charges, or how the account obtained the npm publish token it used. npm has not said publicly whether it has closed the specific gap that let an already-fingerprinted hash back onto the registry, and did not respond to IT Pro's request for comment on that question either.

The incident follows a pattern The Terminal has covered elsewhere in the agent and package ecosystem: Snyk reported this month that it found confirmed malicious payloads in 76 of 3,984 AI agent skills it scanned across public marketplaces, and a stolen vendor API credential separately let attackers reach patient data in Veradigm's third breach in two years. In each case, the entry point was not a novel exploit but a credential or a hash that a scanner should have already known to block.