← Back to feed
2026-08-20 Supply ChainMalware TLP:CLEAR

Shai-Hulud npm Worm: Keyv and 400+ Packages Compromised via GitHub Maintainer Account Takeover on August 4, 2026

Date: 2026-08-20
Tags: supply-chain, malware

Executive Summary

A credential-stealing npm worm compromised over 1,300 package versions on the npm registry on August 4, 2026, affecting widely used caching libraries such as keyv, cacheable, flat-cache, and file-entry-cache. The malicious releases add a preinstall hook that runs an obfuscated loader before application code starts, then launches a much larger second-stage payload. The campaign represents a combined 2 billion monthly downloads.

Campaign Summary

FieldDetail
Campaign / MalwareShai-Hulud npm worm family (Mini Shai-Hulud variant)
AttributionUnknown; TTPs consistent with TeamPCP but source code publicly released (confidence: low)
Targetnpm developers and CI/CD pipelines using keyv, cacheable, flat-cache, file-entry-cache, and 400+ downstream packages
VectorCompromised GitHub maintainer account; direct commit and release to npm registry with valid GitHub Actions provenance
Statusactive
First Observed2026-08-04

Detailed Findings

On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv, a key-value storage library with roughly 127 million weekly npm downloads, and used that access to inject a credential-stealing worm across the entire package family. The same maintainer owns cacheable (29M downloads/month), flat-cache (565M downloads/month), file-entry-cache (557M downloads/month), and several other widely-used caching utilities, all of which were swept up in the same attack. The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed; setup.mjs is a heavily obfuscated dropper. Semgrep documented the same Claude Code and VS Code hooks, setup.mjs filename and Bun 1.3.13 download in an April compromise of the lightning PyPI package, linking this to the broader Shai-Hulud malware family. The worm moved between organizations every two to seven minutes and completed the cross-organization publishing burst in roughly half an hour. A credential-stealing npm worm that first appeared in [email protected] spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195.001Compromised npm maintainer account to inject malware into widely-used packages
Credential AccessT1556Preinstall script exfiltrates developer and CI/CD credentials
PersistenceT1547.013npm preinstall lifecycle hook executes obfuscated loader on package installation

IOCs

Domains

_Over 1,300 package versions compromised across 400+ distinct npm packages. Valid GitHub Actions provenance signatures used. Bun 1.3.13 user-agent observed in malware C2 communications._

Full URL Paths

_Over 1,300 package versions compromised across 400+ distinct npm packages. Valid GitHub Actions provenance signatures used. Bun 1.3.13 user-agent observed in malware C2 communications._

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

{'name': 'keyv', 'registry': 'npm', 'version': '6.0.0', 'note': 'Initial compromise; preinstall hook with setup.mjs dropper'}
{'name': 'cacheable', 'registry': 'npm', 'version': 'affected', 'note': 'Part of same maintainer ecosystem'}
{'name': 'flat-cache', 'registry': 'npm', 'version': 'affected', 'note': '565M monthly downloads; same family'}
{'name': 'file-entry-cache', 'registry': 'npm', 'version': 'affected', 'note': '557M monthly downloads; same family'}
{'name': '@cacheable/utils', 'registry': 'npm', 'version': 'affected', 'note': 'Downstream propagation'}
{'name': 'cache-manager', 'registry': 'npm', 'version': 'affected', 'note': 'Downstream propagation'}

Affected Platforms

Node.js
npm registry
CI/CD pipelines
Developer workstations

Detection Recommendations

Monitor npm package installations for preinstall script execution and setup.mjs files. Implement npm lifecycle script disabling via --ignore-scripts during installation and maintain narrow allowlist for legitimate scripts. Review GitHub commit history for all keyv-family packages and downstream dependents. Scan for setup.mjs and Math_Symbol.js files in node_modules. Monitor for Bun/1.3.13 user-agent requests to non-standard domains. Audit all developer and CI/CD credential stores (AWS, GCP, Azure, GitHub tokens) on affected systems. Implement supply chain controls: pin package versions, verify GitHub Actions provenance, enforce code review on all releases, and monitor for unusual GitHub account activity on maintainer accounts.

References