NewsAgency

Shai-Hulud Worm Compromises keyv and Hundreds of npm Packages

2 dakika okuma süresi

Keyv and friends compromised in active Shai-Hulud supply chain attack

Published: Aug 4, 2026 — Aikido Security (Ilyas Makari)

On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv, a key-value storage library with roughly 127 million weekly npm downloads, and used that access to inject a credential-stealing worm across the entire package family. The same maintainer owns cacheable (29M downloads/month), flat-cache (565M downloads/month), file-entry-cache (557M downloads/month), and several other widely-used caching utilities, all of which were swept up in the same attack.

The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions.

Compromised packages (initial wave)

  • keyv 6.0.0 (~604M/month)
  • flat-cache 6.1.24 (~580M/month)
  • file-entry-cache 11.1.6 (~571M/month)
  • cacheable-request 13.0.20 (~137M/month)
  • cacheable 2.5.1 (~30M/month)
  • @cacheable/memory 2.2.1, @cacheable/utils 2.5.1, @cacheable/node-cache 3.1.2, @cacheable/net 2.1.1
  • cache-manager 7.2.10, ecto 5.0.1

Community spread observed to other maintainers/orgs including @deliveroo/reevent, @or-sdk/invitations, @picsart/ai-sdk, @qlik/embed-runtime, picasso.js.

Update — August 4, 2026, 13:37 CEST: At least 434 packages (across 1381 versions) compromised, combined total over 2 billion monthly installs.

What happened

Every package in the family received two new files, setup.mjs and Math_Symbol.js, plus "preinstall": "node setup.mjs". Anyone who ran npm install against an affected version would execute setup.mjs automatically.

setup.mjs silently downloads the Bun JavaScript runtime (bun-v1.3.13) and executes the real payload Math_Symbol.js (~728 KB obfuscated). The payload harvests secrets, encrypts findings, and exfiltrates them to public GitHub repositories whose description reads “Shai-Hulud: Here We Go Again”. It also contains worm-like propagation to infect packages of other maintainers.

What it steals

  • npm tokens (~/.npmrc, validated via registry whoami)
  • GitHub tokens (PATs, OAuth, App tokens, OIDC; Actions runner memory dump)
  • AWS credentials (files, env, IMDS, Secrets Manager)
  • Kubernetes secrets (service account + API enumeration)
  • HashiCorp Vault tokens and KV secrets
  • Stripe and Slack tokens
  • Generic filesystem scan (~200 globs): .env, private keys, SSH, Terraform state, Docker creds, KeePass, VPN, IDE configs including .vscode and .claude

Exfiltration

Encrypted bundles uploaded to public GitHub repos matching “Shai-Hulud: Here We Go Again” (~1,300 repos observed). Fallback: npm-cache[.]com:443/router.

IOCs (selected)

  • setup.mjs SHA-256: 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668
  • Math_Symbol.js SHA-256: 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc
  • Exfil domain: npm-cache[.]com

DevOps.com / Socket / SafeDep / JFrog also tracked the campaign; counts rose past 1,200+ packages with 50–100 new infections every few minutes during the peak window.

Grafik Görünümü