Shai-Hulud Campaign Compromises Keyv npm Package, Spreading Malware Widely
The popular keyv npm package, downloaded 127 million times weekly, has been compromised by the Shai-Hulud campaign, leading to the injection of credential-stealing malware across numerous related packages.
Attackers have successfully compromised the GitHub account of the maintainer behind the widely-used keyv npm package, a critical component for key-value storage with approximately 127 million weekly downloads. This breach, which occurred on August 4, 2026, has led to the injection of credential-stealing malware into keyv and other packages within the maintainer's portfolio, marking one of the most significant npm supply chain incidents to date. The malicious code rapidly spread to hundreds of unrelated packages within hours, according to research exclusively shared by Aikido.
The compromised maintainer is also responsible for several other heavily downloaded caching utilities, including cacheable (29 million monthly downloads), flat-cache (565 million monthly downloads), and file-entry-cache (557 million monthly downloads), among others. All of these packages were subsequently compromised. The attackers exploited GitHub Actions to generate valid provenance signatures for the malicious releases, making the poisoned versions appear legitimate and harder to detect.
Each affected package was modified to include two new malicious files: setup.mjs and Math_Symbol.js. A preinstall hook was added to package.json, which automatically executes setup.mjs during the npm install process. This obfuscated dropper then downloads the Bun JavaScript runtime from a GitHub release URL and uses it to launch the true payload, Math_Symbol.js, without any visible prompt to the developer.
This self-propagating mechanism is characteristic of the Shai-Hulud campaign and has enabled the malware to spread beyond the original maintainer's packages. It has already infected codebases of major organizations, including those associated with Deliveroo, Qlik, and Picsart. As of an update on August 4, 2026, Aikido reported that at least 868 packages across 1,381 versions had been confirmed as compromised, with the number continuing to rise.
The Math_Symbol.js payload is designed to extract a variety of sensitive credentials. It targets npm registry authentication tokens from .npmrc files, GitHub CLI tokens (including classic personal access tokens, session tokens, and OIDC tokens) from local GitHub CLI configurations, and AWS access keys and session tokens from the ~/.aws/credentials file. Additionally, it attempts to capture HashiCorp Vault client tokens from the VAULT_TOKEN environment variable or via HTTP requests.
The implications of this attack are severe. The stolen credentials are often used for publishing new packages and accessing cloud infrastructure, creating a cascade effect that can lead to further account takeovers and the release of more malicious code. This appears to be the primary method by which the worm continues to propagate throughout the npm ecosystem.
Security teams that rely on keyv, cacheable, flat-cache, file-entry-cache, or any related caching packages are urged to take immediate action. This includes auditing lockfiles for affected versions, rotating all npm tokens, GitHub CLI credentials, AWS keys, and Vault tokens on any machine that ran an installation during the exposure window. Furthermore, fresh installations involving these dependencies should be avoided until patched versions are confirmed. Given the scale and rapid spread, any recent CI pipeline runs involving these packages should be considered potentially compromised.