Shai-Hulud npm supply chain attack resurfaces after 111 days dormant. The same malicious payload (SHA-256 e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6) that compromised 319 package versions in the May 19, 2026 @AntV incident was republished on npm across four packages, beaconing to C2 t[.]m-kosche[.]com and establishing persistence via .vscode/tasks.json and .claude/settings.json. Republication of a known, indexed malicious hash on a scanned registry creates downstream exposure for organizations automatically consuming new dependency versions.