On August 4, 2026, a self-propagating npm worm named Shai-Hulud compromised at least 868 packages exceeding 2 billion monthly installs. The attack hijacked maintainers across nine organisations and planted credential stealers in roughly 30 minutes.
TL;DR: A self-propagating npm worm named Shai-Hulud compromised at least 868 packages with over 2 billion monthly installs on August 4, 2026. The attack hijacked maintainers across nine organisations and planted credential stealers in roughly 30 minutes, according to analysis from OX Security.
How Did the Shai-Hulud npm Worm Compromise Hundreds of Packages?
The Shai-Hulud worm began by hijacking the maintainer account of keyv, a widely-used key-value storage package with millions of weekly downloads. Once the attacker gained publish access, they pushed a malicious version (v6.0.0) containing a credential-stealing payload embedded in the installation scripts. This initial compromise functioned as the launch point for broader propagation across the npm ecosystem.
From there, the worm escalated rapidly. It harvested npm authentication tokens stored on the compromised maintainer’s local development machine. These tokens granted publish rights to other packages and organisations the maintainer had access to. The worm then repeated the cycle automatically, compromising each newly infected package to extract additional credentials and expand its reach further.
The speed was staggering. According to SafeDep’s real-time supply chain monitoring, a byte-identical credential stealer moved through more than 400 packages across nine unrelated organisations in approximately 30 minutes. The automated propagation required no manual intervention after the initial account takeover. Each infected package became a new distribution vector.
This pattern of token theft and lateral movement mirrors techniques seen in previous supply chain incidents, but the scale here is unprecedented. The worm specifically targeted maintainers with privileged access to multiple high-traffic packages, maximizing blast radius with minimal effort.
What Is the Shai-Hulud Campaign and How Does It Propagate?
Shai-Hulud is a self-propagating worm that spreads through npm’s publishing infrastructure by harvesting authentication tokens from compromised maintainer machines. The campaign attributes itself with the message “Shai-Hulud: Here We Go Again,” referencing the sandworm from Frank Herbert’s Dune universe. The name signals a return — earlier iterations of this worm were detected in prior months.
The propagation mechanism works through a tightly automated loop. First, the attacker compromises a single high-privilege maintainer account, likely through credential phishing or token leakage. Once inside, they publish a new version of a popular package containing an install or postinstall script. When downstream developers run npm install, that script executes silently on their machines.
The script then scans for npm tokens in environment variables, .npmrc files, and credential stores. Each harvested token gets validated against the npm registry to determine which packages and organisations it can publish to. Valid tokens are immediately used to push the same malicious payload to every accessible package, creating exponential growth.
OX Security reported that over 440 packages were compromised in this initial wave, with the total later climbing to 868 according to CyberPress tracking. The worm’s byte-identical payload across all affected packages confirms fully automated propagation rather than manual targeting. This changes everything.
Which npm Organisations and Packages Were Affected by the Attack?
The attack affected nine npm organisations including @ornikar, @deliveroo, @keyv, and @cacheable, according to SafeDep’s forensic analysis. The worm spread beyond the initial keyv compromise into unrelated organisations because maintainers held cross-organisation publish privileges. This is common in the npm ecosystem where maintainers contribute to multiple projects.
Keyv and the entire Cacheable ecosystem bore the brunt of the attack. Keyv v6.0.0 was the first confirmed malicious publication, serving as patient zero. From there, the worm propagated into packages like @cacheable/node-cache, @cacheable/redis, and dozens of related modules. The interconnected dependency graph meant that compromising a single core package triggered cascading infections.
The full list of affected packages spans utility libraries, caching modules, configuration tools, and framework extensions. SafeDep’s monitoring identified the following patterns across compromised packages:
- Malicious versions were published in rapid succession within a 30-minute window
- All infected packages shared byte-identical credential-stealing code
- The worm targeted packages with combined monthly installs exceeding 2 billion
- Affected maintainers had overlapping publish rights across multiple organisations
- Compromised packages included both direct dependencies and transitive dependencies
- The attack reached production environments within hours of initial publication
- Several packages received multiple malicious version bumps in sequence
- npm registry takedown occurred after hundreds of versions were already published
| Organisation | Notable Packages | Estimated Monthly Installs |
|---|---|---|
| @keyv | keyv, @keyv/redis, @keyv/mongo | ~8 million |
| @cacheable | node-cache, redis, lookup | ~12 million |
| @deliveroo | config, logger, utils | ~3 million |
| @ornikar | shared, constants, types | ~2 million |
| Other orgs | Various utility packages | ~15 million |
The combined install volume across all 868 affected packages exceeds 2 billion monthly downloads, meaning the potential blast radius reached an enormous portion of the JavaScript development community.
What Type of Malware Was Injected Into the Compromised Packages?
The injected malware is a credential stealer that targets npm authentication tokens, environment variables, and development tool configurations. The payload was byte-identical across all 868 compromised packages, confirming automated injection rather than manual planting. SafeDep’s analysis confirmed the identical signature across every infected version.
The credential stealer specifically targets sensitive files and data sources on developer machines. According to The Hacker News reporting, the malware plants hooks into Claude Code and VS Code configurations, allowing attackers to intercept API keys and authentication tokens used by these tools. This extends the attack surface beyond npm itself into AI-assisted development workflows.
The payload operates through npm’s lifecycle scripts, specifically postinstall hooks that execute automatically when a developer installs the package. These scripts run with the developer’s full filesystem permissions. The malware scans for:
- npm tokens stored in
~/.npmrcfiles - Environment variables containing
NPM_TOKEN,NODE_AUTH_TOKEN, and similar credentials - Claude Code API keys and configuration files
- VS Code stored credentials and workspace settings
- Cloud provider credentials (AWS, GCP, Azure) in standard locations
- Database connection strings in
.envfiles - SSH private keys in
~/.ssh/ - Git credentials cached by credential managers
Harvested data gets exfiltrated to attacker-controlled endpoints. The malware then cleans up after itself to avoid detection, removing temporary files and modifying logs. The self-cleaning behavior delayed discovery, allowing the worm to propagate extensively before security researchers identified the campaign.
The targeting of Claude Code and VS Code configurations represents an evolution in supply chain attack patterns. By compromising AI coding assistants, attackers can potentially influence code generation, intercept proprietary codebases, and harvest API credentials for large language model services. This adds a new dimension to the traditional credential theft model.
How Does This Attack Target VS Code and Claude Code Users?
The Shai-Hulud worm specifically hooks into VS Code and Claude Code to intercept developer credentials during active sessions. According to analysis from The Hacker News, the malicious payload plants hooks that monitor authentication flows within these tools (The Hacker News, 2026). This means developers who had compromised packages installed risked exposing their session tokens.
The attack works silently. Once the worm infects a project, it injects code that watches for credential exchanges. VS Code extensions that interact with npm registries become a primary target. Claude Code users face similar exposure when the AI assistant interacts with package management systems.
Security researchers at OX Security confirmed that the credential stealer operates by capturing environment variables and authentication headers (OX Security, 2026). The stolen data gets exfiltrated to attacker-controlled servers. This allows threat actors to impersonate developers across multiple services.
Why does this matter for enterprise teams? Because session tokens often bypass multi-factor authentication. A stolen token grants full access without triggering security alerts. The worm’s ability to target these specific development tools makes it particularly dangerous for organizations relying on AI-assisted coding workflows.
What Makes This npm Supply Chain Attack Different From Previous Incidents?
Unlike typical npm supply chain attacks that target a single package or maintainer, Shai-Hulud propagated autonomously across nine unrelated organisations in approximately 30 minutes on August 4, 2026 (SafeDep, 2026). This self-propagating behavior distinguishes it from previous incidents that required manual intervention for each compromised package.
The worm carried one byte-identical credential stealer across all 868 affected packages (CyberPress, 2026). Previous attacks like the 2018 event-stream compromise typically affected one package at a time. Shai-Hulud’s worm-like propagation mechanism allowed it to spread exponentially through dependency trees.
Key differences from past incidents include the speed of propagation, the breadth of affected organisations, and the autonomous nature of the spread. The attack did not require social engineering for each individual package. Once initial access was achieved through the keyv maintainer account, the worm handled the rest.
The scale is unprecedented. Over 2 billion monthly downloads across the affected packages means the potential blast radius dwarfs previous supply chain incidents (CyberPress, 2026). The attack also demonstrated that multi-factor authentication on npm accounts alone cannot prevent worm-based propagation once an initial foothold is established.
How Can Developers Detect If Their Projects Were Compromised?
Developers should immediately check their lockfiles and installed dependency trees against the published list of 868 compromised packages identified by SafeDep and CyberPress. The compromised versions include keyv v6.0.0 and multiple packages within the Cacheable ecosystem (SafeDep, 2026).
Detection starts with auditing. Run npm ls to inspect your dependency tree for affected versions. Check for any packages published between August 4, 2026 and the date npm removed the malicious versions. Look specifically for post-install scripts that you did not author.
The credential stealer leaves traces. Security researchers recommend checking environment variables for unexpected modifications. Monitor outbound network connections from development machines for unfamiliar IP addresses. Review Claude Code and VS Code authentication logs for anomalies.
Automated tools can help. Socket.dev and similar supply chain security platforms have published detection rules for Shai-Hulud payloads. Running npm audit alone is insufficient because the compromised packages were published under legitimate version numbers. Manual verification against known indicators of compromise remains necessary.
A critical step involves checking CI/CD pipeline logs. The worm could have spread through build systems that install dependencies automatically. Any pipeline that ran between August 4 and the remediation date should be treated as potentially compromised.
What Security Measures Can Prevent npm Worm Propagation?
Preventing worm propagation requires multiple layers of defense since no single control stops self-spreading supply chain attacks. Organizations should implement the following measures based on analysis from SafeDep and OX Security:
- Pin all dependencies using lockfiles and enforce
npm ciin CI/CD pipelines instead ofnpm installto prevent unexpected version updates - Enable npm provenance attestations and verify package signatures before installation to ensure packages come from expected build systems
- Monitor post-install scripts by configuring
.npmrcwithignore-scripts=trueand manually reviewing any package that requires execution during installation - Implement network segmentation in development environments to prevent credential stealers from exfiltrating data to attacker-controlled infrastructure
- Use package scoring tools like Socket.dev or Snyk to automatically flag packages exhibiting suspicious behavior patterns such as new maintainers or unexpected network access
- Rotate all credentials regularly including npm tokens, API keys, and session tokens for VS Code and Claude Code to limit the window of exposure
- Maintain an internal npm registry mirror that acts as a checkpoint where packages can be reviewed before reaching production environments
- Require multi-person approval for dependency updates in critical projects to ensure no single developer can introduce a compromised package
- Audit transitive dependencies regularly since worms like Shai-Hulud propagate through deeply nested package relationships
| Security Measure | Implementation Difficulty | Effectiveness Against Worms |
|---|---|---|
| Lockfile pinning | Low | Medium |
| Provenance verification | Medium | High |
| Script blocking | Low | High |
| Network segmentation | High | High |
| Package scoring tools | Medium | Medium |
| Internal registry mirror | High | High |
| Multi-person approval | Medium | Medium |
| Credential rotation | Low | Medium |
How Did the Security Community Respond to the Attack?
The security community responded within hours of the Shai-Hulud worm’s discovery on August 4, 2026. SafeDep published a real-time analysis identifying 400+ compromised packages across nine organisations, which later expanded to 868 packages (SafeDep, 2026). npm registry administrators removed the malicious versions promptly.
OX Security released a detailed breakdown of affected packages within the Cacheable ecosystem and keyv dependency tree (OX Security, 2026). Their analysis helped developers identify whether their projects included compromised transitive dependencies. The CyberSec Guru provided continuous updates as new affected packages were discovered.
GitHub Security Advisory published CVE entries for the primary compromised packages. Multiple security vendors including Socket.dev, Snyk, and Checkmarx updated their scanning rules to detect Shai-Hulud indicators of compromise. The open-source community rallied to audit dependent packages and report additional casualties.
SourceTrail documented the broader campaign context including phishing attempts and credential theft tactics that complemented the worm’s automated propagation (SourceTrail, 2026). Their coverage highlighted that Shai-Hulud represents an evolving threat that combines multiple attack vectors beyond just the worm mechanism.
The maintainer of keyv regained control of the package and published cleaned versions. However, the incident sparked renewed discussions about npm’s account security model and whether the registry should mandate hardware security keys for all package maintainers with significant install counts.
Frequently Asked Questions
Was the popular Keyv package directly compromised in the attack?
Yes, keyv version 6.0.0 was directly compromised when attackers gained control of the maintainer account (The CyberSec Guru, 2026). The keyv package served as the initial vector from which the Shai-Hulud worm propagated to 868 additional packages across the npm ecosystem.
How fast did the Shai-Hulud worm spread across npm packages?
The worm spread through more than 400 packages across nine unrelated organisations in approximately 30 minutes on August 4, 2026 (SafeDep, 2026). This autonomous propagation speed demonstrates the worm-like capability that distinguishes Shai-Hulud from traditional supply chain attacks.
What should developers do if they installed compromised packages?
Developers should immediately remove all compromised package versions, rotate all credentials including npm tokens and API keys, and audit their CI/CD pipelines for unauthorized access (SourceTrail, 2026). The compromised packages span the keyv and Cacheable ecosystems with over 2 billion monthly downloads, so thorough dependency tree inspection is critical.
How many monthly downloads were affected by the worm?
The 868 compromised packages collectively exceeded 2 billion monthly installs at their peak (CyberPress, 2026). This massive download volume means thousands of projects potentially pulled in malicious code before npm removed the affected versions from the registry.
Summary
The Shai-Hulud npm worm represents a new class of supply chain threat that combines autonomous propagation with targeted credential theft. Key takeaways for developers and security teams:
- The worm spread to 868 packages with 2+ billion monthly downloads in approximately 30 minutes, demonstrating unprecedented speed for npm supply chain attacks
- VS Code and Claude Code users face specific risks from credential-stealing hooks that intercept authentication tokens during development sessions
- Lockfile pinning and script blocking provide immediate protection against worm propagation by preventing unexpected package installations and post-install execution
- Credential rotation is mandatory for any project that may have pulled compromised packages between August 4, 2026 and npm’s remediation
- The security community responded rapidly but the attack’s scale shows that reactive measures alone are insufficient for modern supply chain threats
Review your dependency trees today. Check the SafeDep and CyberPress published lists of affected packages against your projects. Rotate credentials if you find matches. The open-source ecosystem’s security depends on collective vigilance.