---
id: 7533
title: "Shai-Hulud Rises From the Dead after 111 days"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/shai-hulud-npm-resurfaces"
published_at: "2026-09-07T00:00:00Z"
tags: ["supply-chain", "malware", "npm", "worm", "shai-hulud", "antv"]
phying_url: "https://phying.com/item/7533"
lang: en
---

# Shai-Hulud Rises From the Dead after 111 days

## Summary

The Shai-Hulud npm worm payload behind May's @AntV attack resurfaced after 111 days: four new packages on September 7 carried the identical hash, despite npm's new publish-time malware scanning.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-09-07T00:00:00Z
- **Original:** https://www.aikido.dev/blog/shai-hulud-npm-resurfaces
- **Phying News:** https://phying.com/item/7533