Skip to content

Back to the catalog

Keyv and friends compromised in active Shai-Hulud supply chain attack
aikido.devadvisory

Keyv and friends compromised in active Shai-Hulud supply chain attack

Aikido Security reports that Keyv and several related npm packages were compromised as part of the ongoing Shai-Hulud supply-chain attack, in which malicious versions were published to npm to spread a self-replicating worm across the ecosystem. The write-up details the affected packages and versions and the worm's propagation mechanism via compromised maintainer credentials and postinstall scripts.

TL;DR Keyv and related npm packages compromised in the active Shai-Hulud npm supply-chain worm attack.
Open original ↗
Document

What it is

An active instance of the Shai-Hulud npm supply-chain worm that, on August 4, 2026, compromised the GitHub account of the maintainer behind keyv (~127M weekly downloads) and their related caching libraries. By an August 5 update the worm had spread to at least 444 packages across 1,381 versions, totaling over 2 billion monthly installs. Confirmed poisoned versions include keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable-request 13.0.20, cacheable 2.5.1, @cacheable/memory 2.2.1, cache-manager 7.2.10, @cacheable/node-cache 3.1.2, @cacheable/utils 2.5.1, @cacheable/net 2.1.1, and ecto 5.0.1, plus community-spread packages like @deliveroo/reevent 1.0.1, @or-sdk/invitations 1.4.9, @picsart/ai-sdk 3.32.2, @qlik/embed-runtime 1.6.4, and picasso.js 2.11.6.

How it works

Attackers pushed malicious files to main and cut releases via GitHub Actions, so poisoned versions carry valid provenance. Each package gained two files — setup.mjs and Math_Symbol.js — plus a "preinstall": "node setup.mjs" entry (note: the catalog summary says postinstall; the page specifies preinstall). setup.mjs is an obfuscated dropper that downloads the Bun runtime (bun-v1.3.13) and runs the 728 KB payload Math_Symbol.js, which harvests secrets, encrypts them under an attacker-held RSA key, and exfiltrates to a public GitHub repo described "Shai-Hulud: Here We Go Again", then self-propagates.

What it steals

  • npm tokens: ~/.npmrc scan, validated live against registry.npmjs.org/-/whoami.
  • GitHub tokens: ghp_/gho_/ghs_ and OIDC JWTs; on Actions runners it dumps runner process memory and reads ACTIONS_ID_TOKEN_REQUEST_TOKEN/_URL.
  • AWS: credentials files, env vars, IMDSv2→IMDSv1, ECS metadata (169.254.170.2), and Secrets Manager ListSecrets across regions.
  • Kubernetes: service-account token to query the API for all namespace secrets; KUBECONFIG, ~/.kube/config.
  • Vault: six sources including VAULT_TOKEN, ~/.vault-token, K8s and AWS IAM auth; enumerates all KV mounts.
  • Stripe/Slack keys, plus a ~200-pattern filesystem scan for .env*, private keys, SSH keys, Terraform state, docker/config.json, .kdbx, .ovpn, .vscode/tasks.json, .claude/settings.json.

What to do

The page gives no explicit remediation commands. Actionable IOCs: audit lockfiles/installs for the listed versions, the files setup.mjs/Math_Symbol.js, and any preinstall: node setup.mjs. Treat any machine or CI runner that ran an affected npm install as fully compromised and rotate all secrets it could reach — npm, GitHub, AWS, K8s, Vault, Stripe, Slack — since exfiltration is encrypted and cannot be recovered.

Caveats

Provenance signatures are valid here, so provenance checks will not flag these releases. The 444-package / 2B-install figure is a point-in-time August 5 count of an actively spreading worm; the true blast radius is larger.

Organisations named here

  • Shai-Hulud

Technologies named here

  • npm
  • Node.js
  • keyv

Related in Supply Chain