Executive Summary
In September 2026, threat intelligence analysts identified the reactivation of the Shai-Hulud worm payload on the npm registry. The malware, which first appeared in May 2026 during the '@AntV' supply chain attack, resurfaced using an identical file hash (SHA256: e37e3...b1a6) after 111 days of inactivity. Four new packages, published by a single account, were found to carry the exact worm payload despite npm's implementation of publish-time malware scanning.
The attack involves a multi-stage infection cycle where the malware steals npm tokens, validates them against the registry, and then automates a republishing cycle to propagate itself. It targets developer environments by injecting payloads into legitimate package structures and establishing persistence through VS Code and Claude AI settings files.
This resurfacing demonstrates a significant failure in automated registry-level signature matching, as the payload remained unchanged from previous well-documented campaigns. Organizations utilizing npm packages should immediately audit their dependencies for the identified package names and file hashes to prevent supply chain contamination.