Keyv npm package compromised in supply chain attack

Key Takeaways

• The GitHub account of the maintainer for the popular npm package ‘keyv’ and related caching utilities was compromised.
• Attackers injected credential-stealing malware, named “Shai-Hulud,” into numerous packages, affecting over 868 packages and 1,381 versions.
• The malicious code propagated rapidly, leveraging valid GitHub Actions provenance signatures to appear legitimate.
• The malware targets npm, GitHub CLI, AWS, and HashiCorp Vault credentials, posing a significant supply chain risk.
• Immediate action is required for users of affected packages, including auditing lockfiles, rotating credentials, and avoiding fresh installs.

Major npm Supply Chain Attack Compromises Keyv and Related Packages

In a significant supply chain incident impacting the npm ecosystem, attackers gained unauthorized access to the GitHub account of the maintainer behind “keyv,” a widely used key-value storage library. This breach, which occurred on August 4, 2026, allowed threat actors to inject credential-stealing malware across the maintainer’s entire portfolio of packages, leading to a rapid and widespread compromise.

The “keyv” package alone accounts for approximately 127 million weekly downloads on npm. The compromise extended to several other high-traffic caching utilities managed by the same individual, including “cacheable” (29 million monthly downloads), “flat-cache” (565 million monthly downloads), “file-entry-cache” (557 million monthly downloads), “cache-manager,” “cacheable-request,” and all “@cacheable” scoped packages. Research detailing the incident was shared exclusively with Cybersecuritynews by Aikido.

Stealthy Distribution and Rapid Propagation

The attackers employed a sophisticated method to distribute the malicious code. They pushed the compromised files directly to each repository’s main branch and immediately issued new releases. This tactic resulted in the poisoned versions being published to npm with legitimate provenance signatures generated by GitHub Actions, effectively masking their true nature from supply chain integrity audits.

Every affected package received two new files: setup.mjs and Math_Symbol.js. A “preinstall” hook was surreptitiously added to the package.json file, configured to automatically execute setup.mjs during any npm install operation. When triggered, setup.mjs functions as a heavily obfuscated dropper. It discreetly downloads the Bun JavaScript runtime from a GitHub release URL, subsequently using Bun to launch the primary payload, Math_Symbol.js, without any visible indication to the developer performing the installation.

This self-propagating design, part of what researchers have dubbed the “Shai-Hulud” campaign, enabled the malware to spread beyond the initial maintainer’s packages. Within hours, it reportedly infected codebases belonging to major organizations, including Deliveroo, Qlik, and Picsart, among others. As of an update issued at 13:20 CEST on August 4, at least 868 packages across 1,381 versions were confirmed to be compromised, with researchers continuing to track the ongoing spread across the npm registry, Aikido said.

Credential Theft Capabilities

The core functionality of Math_Symbol.js revolves around a suite of targeted credential extractors. These modules are designed to harvest sensitive information from common secret stores found on developer workstations and continuous integration (CI) runners:

• It extracts npm registry authentication tokens from .npmrc files.
• GitHub CLI tokens, encompassing classic personal access tokens, session tokens, and OIDC tokens, are harvested from local GitHub CLI configurations.
• AWS access keys and session tokens are directly retrieved from the ~/.aws/credentials file.
• The malware also attempts to capture HashiCorp Vault client tokens by reading the VAULT_TOKEN environment variable, with a fallback mechanism to retrieve a token over HTTP if the variable is not present.

The theft of these critical credentials—which are used to publish new packages and access cloud infrastructure—creates a severe risk of cascading account takeovers and further malicious releases. This mechanism appears to be precisely how the “Shai-Hulud” worm has continued its propagation throughout the npm ecosystem.

What You Should Do

• Immediately audit your project’s lockfiles (e.g., package-lock.json, yarn.lock) for any affected versions of keyv, cacheable, flat-cache, file-entry-cache, or any related caching packages.
• Rotate all npm tokens, GitHub CLI credentials (including personal access tokens, session tokens, and OIDC tokens), AWS keys, and HashiCorp Vault tokens on any machine or CI environment that executed an npm install or similar package installation command during the exposure window (since August 4, 2026).
• Avoid running fresh installations against dependency trees that include affected packages until confirmed patched versions are available and validated.
• Treat any recent CI pipeline run involving these packages as potentially compromised and conduct a thorough investigation.
• Monitor official announcements from the package maintainers and security advisories for updates on patched versions and further mitigation guidance.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.