On August 4, 2026, attackers hijacked the GitHub account of a maintainer behind keyv, a JavaScript key-value storage library with roughly 127 million weekly npm downloads. Within hours, a credential-stealing worm had spread to at least 868 npm packages carrying over 2 billion monthly installs, sweeping secrets from npm, AWS, Kubernetes, and Vault configurations across the JavaScript ecosystem.
TL;DR: Attackers compromised the GitHub account of a keyv maintainer on August 4, 2026, pushing malicious versions that spread a credential-stealing worm to over 868 npm packages with more than 2 billion monthly downloads. The malware targets npm, AWS, Kubernetes, and Vault secrets, then self-propagates to additional maintainer accounts through stolen credentials.
What Is the Shai-Hulud npm Supply Chain Attack?
Shai-Hulud is a self-propagating worm that targets npm package maintainers by stealing credentials and using them to publish trojanized versions of additional packages. Security researchers at Aikido Security identified the current campaign as a variant dubbed “Mini Shai-Hulud,” which began with the compromise of the keyv ecosystem on August 4, 2026. The worm spreads laterally across the npm registry, turning each infected package into a launchpad for the next. The scale is massive. According to OX Security, the campaign has compromised over 440 packages with a combined 2 billion monthly downloads, while later reporting from International Cyber Digest pushed the count to at least 868 packages. The name references Frank Herbert’s Dune sandworm, a nod to the attack’s burrowing, self-replicating behavior through dependency trees.
The attack chain follows a predictable but devastating pattern. A malicious preinstall hook fires when a developer runs npm install, dropping a credential stealer onto the machine. That stealer sweeps local configuration files, environment variables, and cloud credential stores for authentication tokens. Once harvested, those tokens are exfiltrated through GitHub’s own API, blending into legitimate traffic. The attackers then use the stolen npm tokens to publish new malicious versions of packages maintained by the compromised accounts, restarting the cycle.
How Did Attackers Compromise the Keyv Package?
The initial entry point was the GitHub account of a keyv maintainer, though the exact method of account compromise has not been publicly confirmed. Attackers gained sufficient access to publish trojanized releases directly to the npm registry under the maintainer’s identity. The malicious version, keyv@6.0.0, was pushed as a seemingly legitimate update. According to Wiz Research, multiple keyv and cacheable npm packages were affected in the same window, suggesting the attackers moved quickly across related repositories once they obtained access.
The trojanized release contained a modified preinstall script that executed silently during installation. Cybersecurity News reported that the library pulls roughly 127 million weekly downloads, meaning the blast radius of even a short-lived malicious release is enormous. The package was available for installation before maintainers and security teams identified the tampering. npm subsequently removed the malicious versions, but the worm had already begun spreading to downstream packages through credentials stolen from developers who installed the poisoned release.
The attack exploited a fundamental weakness in the npm ecosystem: the trust relationship between developers and package maintainers. When a maintainer’s credentials are compromised, attackers inherit the full trust that millions of projects place in that maintainer’s packages.
Which Packages and Libraries Are Affected?
The affected package list extends well beyond keyv itself. The cacheable package family, maintained by the same ecosystem of contributors, was among the first wave of downstream infections. Phoenix Security reported that over 1,000 npm package versions were trojanized across the campaign. OX Security’s initial count of 440-plus packages grew as the worm propagated, with International Cyber Digest later confirming at least 868 compromised packages.
Affected packages span several categories:
- keyv and its storage adapters (keyv-redis, keyv-mongo, keyv-sqlite, keyv-mysql, keyv-postgres, keyv-etching)
- cacheable and related caching libraries
- Packages depending transitively on keyv or cacheable in their dependency trees
- Additional packages whose maintainers had their npm tokens stolen during the first wave
- Popular utility libraries caught in the second and third propagation rounds
- Packages with shared maintainers across the keyv and cacheable ecosystems
- Downstream packages that triggered
npm installduring the active attack window
| Package Family | Estimated Weekly Downloads | Status |
|---|---|---|
| keyv (core) | ~127 million | Malicious versions removed |
| cacheable | ~40 million | Malicious versions removed |
| keyv adapters (combined) | ~60 million | Under investigation |
| Downstream dependents | 2 billion+ monthly | Active monitoring |
SC Media reported that the attack is believed to be directly related to the broader Mini Shai-Hulud campaign tracked by multiple security vendors. The interconnected nature of the JavaScript package ecosystem means that a single high-traffic library compromise can cascade into hundreds of downstream infections within hours.
How Does the Worm Propagate Across Maintainer Accounts?
The worm’s propagation mechanism is what sets Shai-Hulud apart from typical supply chain attacks. After the initial keyv compromise, the malware does not simply sit on the infected machine. It actively hunts for credentials that grant publish access to other npm packages. When a developer or CI/CD system installs the trojanized package, the preinstall script executes and begins scanning for npm authentication tokens stored in .npmrc files, environment variables, and CI runner configurations.
Once the stealer finds valid tokens, it exfiltrates them through GitHub’s API. Security Boulevard reported that the trojanized keyv@6.0.0 release specifically exfiltrates CI secrets through GitHub’s own infrastructure, making the outbound traffic appear as normal API calls. The attackers then use those stolen tokens to authenticate to the npm registry and publish new malicious versions of any package the compromised token can access.
This creates a chain reaction. Developer A installs the poisoned keyv package. The stealer grabs Developer A’s npm token, which has publish rights to Package B. Attackers publish a trojanized version of Package B. Developer C installs Package B, and the cycle repeats with access to Package D, E, and beyond. Each compromised account potentially unlocks dozens of additional packages, especially in ecosystems where maintainers manage multiple libraries or share publishing rights across collaborative projects.
The worm’s speed is remarkable. Within the first 24 hours of the keyv compromise, the package count had already exceeded 440. By the time Aikido Security published its initial advisory, the number had climbed past 868. The exponential growth curve mirrors classic worm behavior seen in network-level attacks like Code Red and SQL Slammer, but applied to the software supply chain.
What Credentials and Secrets Does the Malware Steal?
The stealer component targets a broad spectrum of developer and infrastructure credentials. According to reporting from DevOps.com and analysis from multiple security firms, the malware sweeps for secrets across multiple layers of the development stack. The primary targets include npm authentication tokens, which provide direct publish access to the registry, and GitHub personal access tokens, which can unlock source code repositories and additional CI/CD pipelines.
Beyond registry and repository credentials, the malware hunts for cloud infrastructure secrets. AWS access keys stored in environment variables or credential files are a priority target, given their potential for direct infrastructure access. Kubernetes service account tokens and kubeconfig files are also swept, potentially exposing cluster-level controls. Vault tokens and configuration files round out the target list, giving attackers potential access to centralized secrets management systems.
The malware specifically scans these locations:
.npmrcfiles containing npm authentication tokens.envfiles with application-level secrets and API keys- AWS credential files at
~/.aws/credentials - Kubernetes kubeconfig files at
~/.kube/config - GitHub tokens in environment variables (
GITHUB_TOKEN,GH_TOKEN) - Vault tokens in environment variables or configuration files
- CI/CD runner secrets across GitHub Actions, GitLab CI, and CircleCI
- SSH private keys stored in default or common directory paths
- Docker registry credentials in
~/.docker/config.json - Cloud provider credentials for GCP and Azure alongside AWS
GBHackers confirmed that the stealer’s design prioritizes credentials that enable further lateral movement through the supply chain. The choice to exfiltrate via GitHub’s API is deliberate. By routing stolen data through api.github.com, the attackers blend their exfiltration traffic into the normal background of CI/CD operations, where GitHub API calls are routine and rarely trigger alerts.
How Does the Attack Abuse GitHub API for Data Exfiltration?
The trojanized keyv package exfiltrates stolen credentials through GitHub’s own API infrastructure, making malicious traffic blend with normal CI/CD operations. According to Security Boulevard’s analysis of the keyv@6.0.0 release, the worm leverages GitHub’s repository and gist endpoints to exfiltrate npm tokens, AWS credentials, and Kubernetes secrets. This approach is stealthy. The traffic appears legitimate to network monitoring tools because GitHub API calls are standard in modern development pipelines.
The malware collects environment variables from infected systems, then encodes and transmits them via authenticated GitHub API requests. Phoenix Security’s technical breakdown confirms the worm targets npm authentication tokens, AWS access keys, Kubernetes service account tokens, and HashiCorp Vault credentials. By routing data through GitHub, the attackers avoid triggering conventional data loss prevention systems. Traditional firewalls rarely block GitHub traffic.
Wiz Research documented that the exfiltration mechanism creates encrypted gists containing harvested secrets, which the attackers can retrieve later. This dead-drop technique means the attackers never need to maintain persistent command-and-control servers. The GitHub API becomes both the transport layer and the storage mechanism.
Security teams face a difficult detection challenge. Distinguishing between legitimate CI/CD GitHub API activity and malicious exfiltration requires deep payload inspection.
Are Claude Code and VS Code Users at Risk?
Yes, the Shai-Hulud worm specifically targets users of Claude Code and Visual Studio Code by planting malicious hooks into their configuration files. The Hacker News reported that the attack modifies VS Code settings to inject hooks that intercept keystrokes and exfiltrate authentication tokens stored in the IDE. Claude Code users face similar exposure.
The worm scans for .vscode/settings.json and Claude Code configuration directories on infected machines. When found, it appends malicious hook entries that execute on editor startup or file save events. These hooks can capture Claude API keys, session tokens, and any credentials typed into the editor environment. Aikido Security researchers confirmed the hooks persist across editor restarts.
Developers who installed keyv or cacheable packages after August 4, 2026 should assume their IDE configurations may be compromised. The malicious hooks operate silently in the background, exfiltrating data through the same GitHub API mechanism used for the primary credential theft. OX Security noted that the worm’s targeting of AI coding assistants represents an evolution in supply chain attack methodology.
The risk extends beyond individual developers. Any team member whose machine runs the compromised packages could unknowingly expose shared project credentials.
What Indicators of Compromise Should Teams Look For?
Security researchers from Aikido Security, Wiz, and Phoenix Security have published detailed IOCs that organizations can use to detect Shai-Hulud infections. The primary indicator is the presence of trojanized package versions in node_modules directories. GBHackers documented specific compromised versions including keyv@6.0.0 and multiple cacheable package releases published after August 4, 2026.
Key indicators of compromise include:
- Unexpected
preinstallorpostinstallscripts inpackage-lock.jsonfiles referencing unfamiliar URLs or obfuscated code - Modified
.vscode/settings.jsonfiles containing hook entries that were not added by the developer - Unauthorized GitHub gists created from organizational accounts containing encoded or encrypted data blobs
- Suspicious GitHub API traffic from build servers or developer workstations showing unusual gist creation patterns
- npm authentication tokens appearing in unexpected environment variable dumps or log files
- New entries in
~/.npmrcor~/.gitconfigfiles pointing to unknown registries or credential helper scripts - Anomalous AWS credential usage patterns from CI/CD pipeline IP addresses that differ from normal build server geography
- Kubernetes service account tokens accessed from developer machines rather than cluster-internal workloads
- HashiCorp Vault token usage logs showing requests from unexpected sources or unusual secret paths
- Network connections from build agents to
api.github.comthat do not correspond to legitimate repository operations
| IOC Category | Specific Indicator | Detection Method |
|---|---|---|
| Package versions | keyv@6.0.0, cacheable@1.x trojanized releases | Check package-lock.json against known-good versions |
| File system | Modified VS Code settings with unknown hooks | Diff against last known-good configuration backup |
| Network | Unusual GitHub gist creation API calls | Inspect proxy logs for POST requests to /gists endpoint |
| Credentials | npm tokens used from unexpected IPs | Review npm access logs for anomalous geographic patterns |
| Process | Node.js child processes spawning curl or wget | Monitor process trees during npm install operations |
DevOps.com emphasized that the worm spreads rapidly between packages, so IOCs evolve as new versions are published.
How Should Developers Respond and Rotate Credentials?
Organizations should immediately audit their npm dependencies for keyv and cacheable packages, then rotate all credentials that may have been exposed. Wiz Research recommends treating any system that ran npm install after August 4, 2026 as potentially compromised. The response requires urgency.
The credential rotation checklist includes npm access tokens, GitHub personal access tokens and SSH keys, AWS access keys and secret keys, Kubernetes service account tokens, HashiCorp Vault tokens, and any API keys stored in environment variables on CI/CD runners. Security Online advises revoking all existing tokens rather than checking individual usage logs, given the worm’s ability to exfiltrate credentials silently.
Phoenix Security published specific remediation steps for affected projects. First, pin all keyv and cacheable dependencies to versions published before August 4, 2026. Second, regenerate package-lock.json files from a trusted registry mirror. Third, wipe and rebuild all CI/CD runner images and container build environments. Fourth, audit GitHub gists under all organizational accounts for unauthorized entries.
SC Media noted that the attack’s self-propagating nature means a single compromised package can reinfect cleaned environments if any dependency remains unpatched. The worm spreads through maintainer credentials, so every transitive dependency of an infected package requires verification.
What Does This Attack Reveal About npm Security?
The Shai-Hulud attack exposes fundamental weaknesses in npm’s trust model, where a single maintainer account compromise can cascade to over 868 packages with billions of monthly downloads. The International Cyber Digest reported that the worm’s self-propagating mechanism allowed it to leap from keyv to hundreds of dependent packages within hours. The blast radius is staggering.
npm’s flat dependency tree means that one compromised package can inject malicious code into thousands of downstream projects. The keyv library alone is imported by over 1,000 other npm packages, creating a deep transitive dependency chain. When the worm harvested maintainer credentials from infected systems, it gained publish access to every repository those maintainers controlled. This is how 440 packages fell.
The attack also highlights the danger of install-time scripts. The worm’s preinstall hook executed automatically when developers ran npm install, requiring no user interaction. Developer-tech reported that Aikido Security has called for npm to disable install scripts by default, a change that would have prevented automatic execution of the malicious payload.
The ecosystem’s reliance on individual maintainers creates a single point of failure. Keyv, despite its massive download numbers, is maintained by a small team. One compromised GitHub account was enough to trigger a cascade affecting billions of downloads.
Frequently Asked Questions
How many packages were compromised in the Shai-Hulud attack?
The International Cyber Digest reported that at least 868 packages were compromised, collectively carrying over 2 billion monthly installs. OX Security’s analysis identified more than 440 compromised package versions across the keyv and cacheable ecosystems, with Phoenix Security documenting over 1,000 trojanized package versions published on August 4, 2026.
Is this related to the earlier Miasma or Shai-Hulud campaigns?
SC Media confirmed that this attack is believed to be related to the Mini Shai-Hulud campaign, a variant of the earlier Shai-Hulud credential-stealing worm family. The attackers branded this iteration as “Shai-Hulud: Here We Go Again” according to OX Security, indicating continuity with previous npm supply chain campaigns targeting maintainer accounts.
What versions of keyv are safe to use?
Versions of keyv published before August 4, 2026 are considered safe, according to Phoenix Security’s analysis. The trojanized release keyv@6.0.0 and subsequent versions published from the compromised maintainer account should be treated as malicious. Developers should pin dependencies to the last known-good version and verify package checksums against a trusted registry mirror.
Does the attack affect packages beyond the npm ecosystem?
While the primary attack vector targets npm packages, the credential theft mechanism affects any service whose tokens are present on infected developer machines. The Hacker News documented that the worm steals AWS credentials, Kubernetes tokens, and HashiCorp Vault secrets, meaning cloud infrastructure and container orchestration systems are at risk regardless of whether they use npm directly.
Summary
The Shai-Hulud npm supply chain attack represents one of the most significant ecosystem compromises in recent history, with key takeaways for every development team:
- Audit your dependencies now. Check for keyv, cacheable, and any packages published after August 4, 2026 from affected maintainers. Over 868 packages were compromised.
- Rotate all exposed credentials. Treat npm tokens, GitHub tokens, AWS keys, Kubernetes secrets, and Vault tokens as compromised if they existed on any machine running the affected packages.
- Pin and verify package versions. Lock dependencies to known-good versions and regenerate lock files from trusted sources.
- Monitor for IOCs. Watch for unauthorized GitHub gist creation, modified VS Code settings, and anomalous API traffic from build systems.
- Reconsider install scripts. Evaluate whether your projects need
preinstallandpostinstallscripts, and advocate for npm to make them opt-in by default.
The attack demonstrates that supply chain security is only as strong as the weakest maintainer account. Review your dependencies today.