Shai-Hulud Wave-C Payload Returns After 111 Days — Including Feishu Docx MCP Server on npm

On 7 September 2026 Aikido Security reported that a single npm account published, within one hour, new versions of four unrelated packages — feishu-docx-mcp@0.3.2 (an MCP server for Feishu/Lark documents), bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, and bmc-translate-utils@1.1.1 — each carrying a root-level index.js with a preinstall script of `bun run index.js` whose SHA-256 (e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6) is byte-identical to the Shai-Hulud "Wave C" payload from the 19 May 2026 @AntV compromise. Aikido had previously seen that exact hash in 319 package versions, all on that May day, then zero hits until 7 September — a 111-day dormancy, the longest they had recorded for this family. The stealer validates stolen npm tokens, re-injects and republishes infected tarballs, creates Dune-themed GitHub repositories, and writes persistence into .vscode/tasks.json and .claude/settings.json. npm replaced the malicious versions with the 0.0.1-security holding package the same afternoon. The operational point Aikido stresses: npm's mid-2026 publish-time malware scanning (a 5–15 minute hold) failed to block a known, already-fingerprinted artifact. This is distinct from the August MCP-registry V.A.P.E / Keyv Shai-Hulud waves already in this feed.

You are affected if you run feishu-docx-mcp 0.3.2.

Do not install or npx the listed versions; confirm lockfiles and agent MCP configs never pin feishu-docx-mcp@0.3.2 or the sibling CLIs. If any of those versions ran, treat the host as credential-compromised: rotate npm tokens, GitHub credentials, cloud keys and SSH material, and delete unexpected entries in .claude/settings.json and .vscode/tasks.json. Prefer pinned versions and an internal npm mirror over `npx -y <mcp-package>` for MCP servers agents auto-install. Block known C2 t.m-kosche.com from the May wave if still observed. Do not assume registry publish-time scanning will catch even hash-identical known malware.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run feishu-docx-mcp and which version, then enforce a policy on it.