npm: Known Worm Evades Registry Malware Scanning After 111-Day Dormancy

On September 7, 2026, the Shai-Hulud npm worm payload reappeared on the registry with the exact same SHA-256 documented four months prior. The event bypassed the publish-time malware scanning system npm introduced in July 2026, which holds packages for 5-15 minutes for automated analysis. The return after 111 days of inactivity is not a technical novelty: it is an inadvertent regression test that the registry's security system failed on the most elementary case possible.

111 Days of Silence, Then an Exact Match

Aikido recorded 319 package versions with the Shai-Hulud hash on May 19, 2026, during the campaign that compromised 639 versions of the @antv scope in a single hour. Between May 20 and September 6, 2026, there were zero detections. Then, on September 7, four new versions appeared with the exact same SHA-256.

The dormancy period is the longest documented for this payload. "That's 111 days of complete silence on that hash. As far as we can tell, that's the longest dormancy-to-reactivation gap we've seen from a Shai-Hulud payload, and it's not close," the Aikido research team wrote. The republication involved no repacking, obfuscation, or code modification: it is an exact match of a known, indexed artifact.

The four republished packages — feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, bmc-translate-utils@1.1.1 — were all published within the same hour on September 7 by the same npm account, according to the source. The command-and-control domain, t[.]m-kosche[.]com, was already present in the May campaign.

The Self-Propagation Mechanism

The worm operates through a closed loop of download, infection, and republication. The preinstall script executes bun run index.js immediately upon installation. The payload steals npm tokens from the compromised machine, validates them against the registry, enumerates packages associated with the account that have publish permissions, injects its own code, increments the version, and automatically republishes.

Persistence is achieved through files created in .vscode/tasks.json and .claude/settings.json, which survive removal of the original package and allow the malware to maintain control even after the infected source code is deleted from the node_modules directory. The source does not specify whether this persistence technique has changed since the May 2026 campaign.

It is unclear whether the npm account used on September 7 is the same one compromised in the @antv campaign or a new account. The dossier documents neither the actor's identity nor the motive for reactivation after the long period of inactivity.

The Failure of Publish-Time Scanning

The core of the event is not the reinfection itself, but its ability to traverse the security control npm had promoted as a structural response. In July 2026, the registry introduced publish-time malware scanning, holding packages for 5-15 minutes for automated analysis before actual publication.

A payload with an identical hash, public for four months, represents the simplest case for a detection system. "A file hash match is a lookup, not a hard problem. It requires no behavioral analysis, sandboxing, or reasoning about obfuscated code's intent," Aikido wrote. Hash-based detection is a direct comparison between an artifact in transit and a database of known indicators: it requires no decompilation, sandbox execution, or heuristic behavioral analysis.

Clearing this minimum bar raises a broader question. "If this is what gets through on the easy case, it's worth asking what a payload that bothered to change a single byte would have done," the research team added. The discrepancy between the promise of automated scanning and operational reality becomes the center of the reading: registry-level scanning did not work even when the attacker made no attempt to evade it.

"Signature matching against known-malicious artifacts is the single easiest bar to clear in this industry, and it's the bar we should all be most alarmed to see missed." — Aikido research team

Why It Matters

The dossier does not specify whether npm subsequently removed the four packages, nor how long they remained available for installation. The number of actual downloads before any potential removal is not quantified. No official npm response or scanning system update after the September 7 incident is documented.

The source does not clarify whether variants with modified hashes passed simultaneously alongside the exact match, making it impossible to determine whether the failure is isolated or systemic. The nature of data exposed by installations — tokens, publish scopes, or other assets — is not detailed beyond the npm token theft mechanism already described.

For developers and DevOps teams, the event documents that registry-level scanning does not constitute a sufficient guarantee against known threats. For the supply-chain security sector, it raises questions about the efficacy of "automated scanning" promises as a primary control. For enterprises, it requires verification for the presence of compromised packages in local caches and CI pipelines, even though the brief does not document specific remedial measures to adopt.

Context of the @antv Campaign

On May 19, 2026, the original Shai-Hulud campaign — dubbed Mini Shai-Hulud by Aikido — had compromised 639 package versions of the @antv scope in one hour, through a compromised maintainer account. The scale of the operation demonstrated the worm's propagation speed and its ability to exploit legitimate publish permissions to self-replicate.

The connection between the May campaign and the September return is limited to the identity of the hash and the C2 domain. The dossier does not establish whether the actor is the same, whether the modus operandi is identical, or whether the reactivation represents a deliberate resumption or an attempt to test the registry's controls. The 111-day dormancy remains a fact without confirmed interpretation of motives.

The republication of an unmodified payload, after such a long period of absence, inadvertently functioned as a regression test: the security system introduced in the interim failed the most elementary verification. This reading, derived directly from Aikido's analysis, does not presuppose that scanning is unusable in every scenario, but documents that it failed in this specific instance and on a basic detection criterion.

Questions and Answers

Was the worm code modified to evade scanning?
No. The dossier explicitly documents that the payload was not repacked, obfuscated, or modified: it is an exact match of a hash known for months.

Are the four packages still available on npm?
The source does not specify whether npm removed them or how long they remained published after September 7, 2026.

How many installations were recorded?
The dossier does not quantify the number of actual installations of the packages before any potential removal.

Sources

• https://www.aikido.dev/blog/shai-hulud-npm-resurfaces
• https://www.cryptika.com/shai-hulud-npm-worm-resurfaces-after-111-days-and-slips-past-malware-scanning/
• https://gbhackers.com/npm-worm-returns-after-111-days/
• https://www.aikido.dev/blog/mini-shai-hulud-antv-npm-supply-chain-attack

Information is based on the cited source and current as of publication.

Sources