Shai-Hulud Payload Reappears in Four npm Packages After 111-Day Gap
Summary
Aikido says four npm packages published September 7 carried the same Shai-Hulud payload hash seen in May, after 111 days without detections in its records. It says the identical known payload passed npm's publish-time scanning.
Key points
- Aikido reports the same SHA-256 payload found in the May @AntV wave appeared in four npm package versions published September 7.
- The packages were [email protected], [email protected], [email protected], and [email protected].
- Aikido says its records show 319 package versions with the hash on May 19, no new detections through September 6, and four new versions on September 7.
- The article says the four packages were published within the same hour by the same npm account.
- Aikido argues the unchanged, previously indexed hash should have been detectable by npm's publish-time malware scanning; the article does not report a response from npm.
- Listed indicators include a preinstall script running index.js, persistence paths in .vscode/tasks.json and .claude/settings.json, and token-validation calls to the npm registry.
Article Details
- Event Type
- Reported reactivation of the Shai-Hulud npm supply-chain malware payload
- Impact
- Aikido reports that four npm package versions published on September 7 carried a SHA-256-identical payload previously seen in the May 19 @AntV attack, after a 111-day gap. The packages were published despite npm's publish-time malware scanning; the article identifies the detection miss as a gap in registry-level scanning.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | t[.]m-kosche[.]com | Identified in the article's IOC section as C2 infrastructure from the original May wave. |
| SHA256 | e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 | SHA-256 hash of the Shai-Hulud payload, reported as identical to the sample found in the four September npm package versions. |