npm ecosystem: Shai-Hulud worm payloads resurface — dormant hash republished after 111 days and tensorlake compromised with a novel variant (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-09-07
Two Shai-Hulud worm events hit npm in late 2026. On 7 September, four packages (feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, bmc-translate-utils@1.1.1) republished the byte-identical @AntV worm payload (SHA256 e37e3d...b1a6) that had been dormant for 111 days, slipping past npm's publish-time malware scanning despite a known hash. On 8 October, tensorlake@0.5.144 was published with a novel Shai-Hulud variant after a threat actor made verified commits as a maintainer; the payload exfiltrates environment variables, secrets, browser credential stores (including 14 crypto extensions via HackBrowserData), uses C2 iseekaigogo[.]com plus an Ethereum dead-drop fallback, and includes a dead-man's switch that wipes machines if an embedded GitHub token is revoked. Any machine that installed affected versions should be treated as fully compromised; no vendor fix applies beyond removing malicious versions.
What to do
- Check whether tensorlake@0.5.144 or the four 7 September packages (feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, bmc-translate-utils@1.1.1) appear in any lockfile, CI cache, or installed node_modules; remove and pin to clean versions
- Treat any machine that installed them as fully compromised: rotate all secrets, tokens, and credentials stored or accessible on those hosts immediately
- Audit GitHub tokens, npm tokens, and cloud credentials for anomalous use; revoke and reissue anything that may have been exfiltrated
- Scan hosts for persistence artifacts (preinstall-invoked Bun payloads, index.js droppers) and browser credential-store access; check for the dead-man's-switch wipe risk before revoking tokens
- Block C2 infrastructure: t[.]m-kosche[.]com, iseekaigogo[.]com, and Ethereum contract 0xb614155Fd88114d40549b259457Bcf921Df091B9 lookups
- Add known Shai-Hulud hashes to internal dependency-scanning blocklists and require malware scanning on installs
Sources
All live incidents on Threat Watch
