Shai-Hulud Campaign Compromises Keyv npm Package, Spreading Malware Widely
The popular keyv npm package, downloaded 127 million times weekly, has been compromised by the Shai-Hulud campaign, leading to the injection of credential-stealing malware across numerous related packages.
Attackers have successfully compromised the GitHub account of the maintainer behind the widely-used keyv npm package, a critical component for key-value storage with approximately 127 million weekly downloads. This breach, which occurred on August 4, 2026, has led to the injection of credential-stealing malware into keyv and other packages within the maintainer's portfolio, marking one of the most significant npm supply chain incidents to date. The malicious code rapidly spread to hundreds of unrelated packages within hours, according to research exclusively shared by Aikido.
The compromised maintainer is also responsible for several other heavily downloaded caching utilities, including cacheable (29 million monthly downloads), flat-cache (565 million monthly downloads), and file-entry-cache (557 million monthly downloads), among others. All of these packages were subsequently compromised. The attackers exploited GitHub Actions to generate valid provenance signatures for the malicious releases, making the poisoned versions appear legitimate and harder to detect.
Each affected package was modified to include two new malicious files: setup.mjs and Math_Symbol.js. A preinstall hook was added to package.json, which automatically executes setup.mjs during the npm install process. This obfuscated dropper then downloads the Bun JavaScript runtime from a GitHub release URL and uses it to launch the true payload, Math_Symbol.js, without any visible prompt to the developer.
This self-propagating mechanism is characteristic of the Shai-Hulud campaign and has enabled the malware to spread beyond the original maintainer's packages. It has already infected codebases of major organizations, including those associated with Deliveroo, Qlik, and Picsart. As of an update on August 4, 2026, Aikido reported that at least 868 packages across 1,381 versions had been confirmed as compromised, with the number continuing to rise.
The Math_Symbol.js payload is designed to extract a variety of sensitive credentials. It targets npm registry authentication tokens from .npmrc files, GitHub CLI tokens (including classic personal access tokens, session tokens, and OIDC tokens) from local GitHub CLI configurations, and AWS access keys and session tokens from the ~/.aws/credentials file. Additionally, it attempts to capture HashiCorp Vault client tokens from the VAULT_TOKEN environment variable or via HTTP requests.
The implications of this attack are severe. The stolen credentials are often used for publishing new packages and accessing cloud infrastructure, creating a cascade effect that can lead to further account takeovers and the release of more malicious code. This appears to be the primary method by which the worm continues to propagate throughout the npm ecosystem.
Security teams that rely on keyv, cacheable, flat-cache, file-entry-cache, or any related caching packages are urged to take immediate action. This includes auditing lockfiles for affected versions, rotating all npm tokens, GitHub CLI credentials, AWS keys, and Vault tokens on any machine that ran an installation during the exposure window. Furthermore, fresh installations involving these dependencies should be avoided until patched versions are confirmed. Given the scale and rapid spread, any recent CI pipeline runs involving these packages should be considered potentially compromised.
This new report details the ChainDrop malware's self-propagating worm-like capabilities, which have now infected over 1,300 npm packages, including popular ones like Keyv and Cacheable. The attack leverages compromised GitHub accounts and GitHub Actions to push malicious code, which then uses the Bun JavaScript runtime to execute an infostealer that exfiltrates a wide array of developer and cloud credentials to a public GitHub repository.
This new report details a massive escalation of the Shai-Hulud campaign, now leveraging the 'Mini Shai-Hulud' variant to compromise over 440 npm packages in under four hours. The attack, which began in the popular keyv package, rapidly spread to other maintainer-controlled packages and eventually affected over 860 packages with billions of combined monthly downloads, significantly expanding the attack's potential reach compared to previous Shai-Hulud waves.
The ChainDrop campaign, identified by Aikido Security, has escalated the Shai-Hulud-like threat by compromising over 430 npm packages, including popular ones like keyv, cacheable, and flat-cache, with a combined two billion monthly downloads. Attackers gained access to a maintainer's GitHub account, pushing malicious code directly to the main branch and publishing poisoned versions with valid provenance. The infostealer targets a wide array of credentials, including npm and GitHub tokens, AWS secrets, and Kubernetes configurations, which are then exfiltrated to a public GitHub repository.
The CHAINDROP worm, attributed to the Shai-Hulud campaign, has significantly expanded its reach by compromising over 400 npm packages, impacting an estimated 1.3 billion monthly downloads. This latest iteration leverages a preinstall hook to steal developer credentials across various platforms, including npm, GitHub, and cloud services, and then uses stolen npm tokens to propagate itself by republishing compromised packages with altered versions.