{
  "entry": {
    "kind": "vuln",
    "slug": "shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx",
    "name": "shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx",
    "vendor": "feishu-docx-mcp",
    "description": "On 7 September 2026 Aikido Security reported that a single npm account published, within one hour, new versions of four unrelated packages — feishu-docx-mcp@0.3.2 (an MCP server for Feishu/Lark documents), bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, and bmc-translate-utils@1.1.1 — each carrying a root-level index.js with a preinstall script of `bun run index.js` whose SHA-256 (e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6) is byte-identical to the Shai-Hulud \"Wave C\" payload from the 19 May 2026 @AntV compromise. Aikido had previously seen that exact hash in 319 package versions, all on that May day, then zero hits until 7 September — a 111-day dormancy, the longest they had recorded for this family. The stealer validates stolen npm tokens, re-injects and republishes infected tarballs, creates Dune-themed GitHub repositories, and writes persistence into .vscode/tasks.json and .claude/settings.json. npm replaced the malicious versions with the 0.0.1-security holding package the same afternoon. The operational point Aikido stresses: npm's mid-2026 publish-time malware scanning (a 5–15 minute hold) failed to block a known, already-fingerprinted artifact. This is distinct from the August MCP-registry V.A.P.E / Keyv Shai-Hulud waves already in this feed.",
    "website": "https://www.aikido.dev/blog/shai-hulud-npm-resurfaces",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "npm",
      "packageName": "feishu-docx-mcp",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-07",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx",
      "aliases": [
        "ti-103"
      ],
      "title": "Shai-Hulud Wave-C Payload Returns After 111 Days — Including Feishu Docx MCP Server on npm",
      "summary": "On 7 September 2026 Aikido Security reported that a single npm account published, within one hour, new versions of four unrelated packages — feishu-docx-mcp@0.3.2 (an MCP server for Feishu/Lark documents), bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, and bmc-translate-utils@1.1.1 — each carrying a root-level index.js with a preinstall script of `bun run index.js` whose SHA-256 (e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6) is byte-identical to the Shai-Hulud \"Wave C\" payload from the 19 May 2026 @AntV compromise. Aikido had previously seen that exact hash in 319 package versions, all on that May day, then zero hits until 7 September — a 111-day dormancy, the longest they had recorded for this family. The stealer validates stolen npm tokens, re-injects and republishes infected tarballs, creates Dune-themed GitHub repositories, and writes persistence into .vscode/tasks.json and .claude/settings.json. npm replaced the malicious versions with the 0.0.1-security holding package the same afternoon. The operational point Aikido stresses: npm's mid-2026 publish-time malware scanning (a 5–15 minute hold) failed to block a known, already-fingerprinted artifact. This is distinct from the August MCP-registry V.A.P.E / Keyv Shai-Hulud waves already in this feed.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft",
        "Malware"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "feishu-docx-mcp",
        "vendor": null,
        "package": "feishu-docx-mcp",
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "0.3.2",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-09-07",
      "modifiedAt": "2026-09-07",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.aikido.dev/blog/shai-hulud-npm-resurfaces"
        }
      ],
      "mitigation": "Do not install or npx the listed versions; confirm lockfiles and agent MCP configs never pin feishu-docx-mcp@0.3.2 or the sibling CLIs. If any of those versions ran, treat the host as credential-compromised: rotate npm tokens, GitHub credentials, cloud keys and SSH material, and delete unexpected entries in .claude/settings.json and .vscode/tasks.json. Prefer pinned versions and an internal npm mirror over `npx -y <mcp-package>` for MCP servers agents auto-install. Block known C2 t.m-kosche.com from the May wave if still observed. Do not assume registry publish-time scanning will catch even hash-identical known malware.",
      "detectedByAnomity": true
    }
  }
}