Keyv: Shai-Hulud Worm Hijacks npm Maintainer Account

On 4 August 2026, attackers compromised the maintainer identity behind keyv, one of the most heavily depended-upon key-value storage libraries in the JavaScript ecosystem, and used that access to publish credential-stealing malware across the maintainer's entire package portfolio. The malicious releases then propagated worm-style using stolen npm tokens. Socket and Wiz researchers, reported by SC Media, put the spread at more than 400 unique packages within hours; OX Security estimates 444 packages and over 2 billion monthly downloads. Download-reach figures for keyv itself differ by source: Cybersecuritynews cites roughly 127 million weekly downloads, while Upwind, which says it was first to flag the malicious release, puts it at approximately 154 million weekly. Endor Labs measures the first-wave seed packages collectively at about 515 million weekly downloads, with keyv, flat-cache and file-entry-cache alone exceeding 450 million. Note that nearly all reporting on this incident is vendor research rather than a victim statement, regulator filing or national CERT advisory; SC Media is the only established security-press outlet among the eight sources reviewed here.

What Happened

The intrusion traces to the compromise of the maintainer account "Jaredwray," which held publishing rights over both the keyv and cacheable npm namespaces. Wiz reports the attacker began at approximately 09:00 UTC by pushing IDE persistence payloads into the keyv repository, then shortly after published a new malicious keyv version. Snyk identifies the primary poisoned artefact as [email protected].

Because the attacker committed the malicious files directly to each repository's main branch and then cut a release through the project's own GitHub Actions pipeline, the poisoned tarballs were published via npm OIDC trusted publishing and carry valid npm signatures and SLSA provenance. To anyone auditing supply chain integrity by signature or provenance alone, the releases looked entirely legitimate. This is the detail that should worry defenders most: provenance attested that the build came from the right repository, and it did.

The blast radius expanded quickly. Cacheable-family packages including cacheable-request, flat-cache, file-entry-cache, cache-manager and the @cacheable scoped packages were swept in, along with ecto per Snyk's enumeration. Socket notes these are foundational transitive dependencies rather than direct installs, describing a representative chain of eslint to file-entry-cache to flat-cache to keyv, meaning most affected users never installed any of them deliberately.

Counts of malicious releases vary with the snapshot time. Snyk, working from independently downloaded tarballs, identified 11 malicious releases under maintainer jaredwray and observed at 11:16 UTC that eight were still tagged latest while three had been removed. Wiz and Socket, tracking the worm's onward spread across other maintainers, both count more than 400 distinct packages. The CyberSec Guru reports that SafeDep identified hundreds of poisoned versions published in a very short window, and that packages maintained by organisations including HubSync, Qlik, OneReach, Ornikar, Deliveroo, ServiceTitan and Picsart were also republished with malicious payloads. That organisational list appears in only one source and should be treated as unconfirmed.

What Was Taken

The payload is a broad-spectrum credential harvester aimed squarely at developer workstations and CI/CD runners. Socket's analysis of the second stage lists cloud keys for AWS, GCP and Azure, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC tokens and npm publishing tokens, plus a "TruffleHog style" sweep of the disk for any other keys and tokens it can find. Upwind independently describes the same target set of AWS credentials, GitHub authentication tokens, npm publishing credentials and Vault secrets.

Wiz extends the inventory to infrastructure secrets, AI-related configuration files and cryptocurrency wallets, and reports the malware also enumerates cloud environments and attempts to identify build runners, positioning itself for onward lateral movement rather than a single smash-and-grab.

Exfiltration runs through GitHub itself. Wiz reports stolen data is pushed to repositories created under compromised identities carrying the description "Shai-Hulud: Here We Go Again." OX Security reports counting 821 GitHub repositories containing that string at the time of its analysis, which offers a rough and rapidly moving proxy for the number of compromised identities rather than a confirmed victim count.

No total volume of stolen credentials has been established by any source, and given that exfiltration is distributed across attacker-created repositories under victim identities, a reliable figure is unlikely to emerge quickly.

Why It Matters

Three properties make this incident materially worse than a typical typosquat or single-package hijack.

First, the provenance problem. The poisoned versions were signed and attested through legitimate infrastructure. Organisations that adopted SLSA provenance verification as their supply chain control received a green light on malicious artefacts. Provenance proves origin, not intent, and this incident is the clearest production demonstration of that gap to date.

Second, the position in the dependency graph. These are not packages developers choose; they are packages developers inherit. A team running eslint in CI may have ingested the payload without any entry in its own manifest referencing an affected name. Detection by direct-dependency review will systematically under-report exposure.

Third, self-propagation. The malware uses harvested npm tokens to enumerate packages the victim can publish to, injects the same preinstall hook, and republishes through OIDC trusted publishing. Every successful credential theft is a potential new seed, which is why counts moved from a handful of releases to 400-plus within a single working day.

Wiz assesses the payload as a descendant of the "Mini" Shai-Hulud malware family, sharing characteristics with the TeamPCP and antv campaigns. This is a maturing toolkit, not a one-off.

The Attack Technique

Execution is install-time. The malicious releases add "preinstall": "node setup.mjs" to the package manifest, so the loader runs before any application code, under the privileges of the developer or the CI runner.

setup.mjs is an obfuscated loader that downloads a standalone Bun runtime from GitHub Releases and uses it to execute the second stage. Snyk measured that second stage, Math_Symbol.js, at 727,680 bytes. Socket describes it as a Bun bundle with strings obscured using a polymorphic basE91 encoding technique. OX Security additionally names math_init.js as an associated filename. Wiz has flagged the user-agent string Bun/1.3.13 as an indicator of compromise for malicious calls related to this activity.

Wiz also reports that the malware resolves its command-and-control domains dynamically via an Ethereum smart contract, a takedown-resistant technique that removes any single fixed domain defenders could sinkhole.

Persistence goes beyond the install. Both Wiz and The CyberSec Guru describe modification of repository configuration files associated with Visual Studio Code and Claude Code, such that simply cloning and opening an affected repository can trigger execution. OX Security reports the malware persists through local AI agents and IDEs, and further claims a dead man's switch that wipes the host if the stolen GitHub token is revoked. That destructive trigger is reported by a single source and has not been corroborated elsewhere, but it materially changes incident response sequencing if true, so treat token revocation on a live host as a decision requiring care.

OX Security also notes the Bun-fetching preinstall behaviour affects environments that have not updated to npm v12, implying newer npm install-script controls provide partial mitigation.

Snyk published advisory SNYK-JS-KEYV-18515941 classifying [email protected] as embedded malicious code under CWE-506. At the time of Snyk's research, no CVE or GitHub Security Advisory had been assigned.

What Organizations Should Do

1. Hunt before you assume you are clean. Search build logs, lockfiles and package caches for the affected keyv, cacheable, flat-cache, file-entry-cache, cache-manager, cacheable-request, @cacheable and ecto versions published on 4 August 2026. Because exposure is overwhelmingly transitive, resolve full dependency trees rather than reviewing direct dependencies. Wiz and Socket are both maintaining running lists of affected packages.
2. Pin or downgrade to a last-known-good release. Snyk noted that no clean successor to [email protected] had been published at the time of its research, so upgrading forward is not yet a remedy. Pin explicitly and re-verify when maintainers publish a vetted release.
3. Rotate every credential the payload targets, from a clean system. AWS, GCP and Azure keys, HashiCorp Vault tokens, Kubernetes service account tokens, npm publishing tokens and GitHub credentials. Assume anything readable on an affected workstation or runner is compromised. Isolate the host first, and hunt for persistence before revoking GitHub tokens given the unconfirmed destructive-trigger reporting.
4. Disable install scripts by default. Enforce --ignore-scripts in CI and developer tooling, or move to npm v12 where install-script handling is tightened. This attack chain dies at step one without preinstall execution.
5. Inspect IDE and AI agent configuration in cloned repositories. Check VS Code workspace settings and Claude Code configuration files for injected commands. Clone-and-open is a live execution path here, not a theoretical one.
6. Stop treating provenance as sufficient. Signed and attested artefacts were malicious in this incident. Pair provenance verification with behavioural analysis of published tarballs, diffing of release contents against source, and alerting on newly introduced lifecycle hooks. Hunt egress logs for the Bun/1.3.13 user-agent and for unexpected GitHub repository creation under your organisation's identities.

Sources: Keyv npm Package with 127M Weekly Downloads Compromised in Shai-Hul... | Keyv, cacheable npm supply chain attack hits 400-plus packages | Inside the keyv npm Supply Chain Compromise Snyk | keyv and cacheable npm Package Hijacked in Supply Chain Attack Wiz... | NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downlo... | A New Infostealer Worm Hits npm, affecting Keyv and Cacheable | Upwind First to Uncover a Massive Keyv Compromise With Potential Ec... | Keyv npm Package Compromised in Massive Supply Chain Attack The Cy...