# shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx: Shai-Hulud Wave-C Payload Returns After 111 Days — Including Feishu Docx MCP Server on npm

> Shai-Hulud Wave-C Payload Returns After 111 Days — Including Feishu Docx MCP Server on npm is a critical-severity supply chain compromise issue in feishu-docx-mcp, a MCP server. Affected: 0.3.2. It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx
- **Aliases:** ti-103
- **Severity:** critical
- **Attack type:** Supply chain compromise, Credential theft, Malware
- **Component:** feishu-docx-mcp (MCP server)
- **Package:** feishu-docx-mcp (npm)
- **Exploited in the wild:** yes
- **Published:** 2026-09-07
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx

## Summary

On 7 September 2026 Aikido Security reported that a single npm account published, within one hour, new versions of four unrelated packages — feishu-docx-mcp@0.3.2 (an MCP server for Feishu/Lark documents), bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, and bmc-translate-utils@1.1.1 — each carrying a root-level index.js with a preinstall script of `bun run index.js` whose SHA-256 (e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6) is byte-identical to the Shai-Hulud "Wave C" payload from the 19 May 2026 @AntV compromise. Aikido had previously seen that exact hash in 319 package versions, all on that May day, then zero hits until 7 September — a 111-day dormancy, the longest they had recorded for this family. The stealer validates stolen npm tokens, re-injects and republishes infected tarballs, creates Dune-themed GitHub repositories, and writes persistence into .vscode/tasks.json and .claude/settings.json. npm replaced the malicious versions with the 0.0.1-security holding package the same afternoon. The operational point Aikido stresses: npm's mid-2026 publish-time malware scanning (a 5–15 minute hold) failed to block a known, already-fingerprinted artifact. This is distinct from the August MCP-registry V.A.P.E / Keyv Shai-Hulud waves already in this feed.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| 0.3.2 | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run feishu-docx-mcp 0.3.2.

## How do I fix it?

Do not install or npx the listed versions; confirm lockfiles and agent MCP configs never pin feishu-docx-mcp@0.3.2 or the sibling CLIs. If any of those versions ran, treat the host as credential-compromised: rotate npm tokens, GitHub credentials, cloud keys and SSH material, and delete unexpected entries in .claude/settings.json and .vscode/tasks.json. Prefer pinned versions and an internal npm mirror over `npx -y <mcp-package>` for MCP servers agents auto-install. Block known C2 t.m-kosche.com from the May wave if still observed. Do not assume registry publish-time scanning will catch even hash-identical known malware.

## How do I find every machine running feishu-docx-mcp?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run feishu-docx-mcp and which version, then enforce a policy on it.

## References

- article: https://www.aikido.dev/blog/shai-hulud-npm-resurfaces

## Related vulnerabilities

- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical
- [shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude](https://catalog.anomity.ai/vuln/shai-hulud-reaches-the-official-mcp-registry-shipping-poisoned-claude) — critical
- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent](https://catalog.anomity.ai/vuln/apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent) — high
- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical
- [gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest](https://catalog.anomity.ai/vuln/gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=shai-hulud-wave-c-payload-returns-after-111-days-including-feishu-docx