Shai-Hulud has escalated again, with a new npm supply chain campaign that hijacked the maintainer of keyv and rippled across at least 868 packages, collectively exceeding 2 billion monthly installs at the time of discovery.
On August 4, 2026, attackers took over the GitHub account of the maintainer behind keyv, a key‑value storage library that sees roughly 127 million weekly downloads on npm.
Aikido Security reported that with valid maintainer access, they pushed malicious commits straight to the main branch and immediately cut new releases, ensuring the poisoned versions were published with legitimate GitHub Actions provenance.
Shai-Hulud npm Worm Compromises 868 Packages
The same maintainer controls cacheable, flat-cache, file-entry-cache, and multiple other high‑volume caching utilities, which were all pulled into the blast radius.
The known compromised builds include keyv 6.0.0 (around 604M installs/month), flat-cache 6.1.24 (580M/month), file-entry-cache 11.1.6 (571M/month), cacheable-request 13.0.20 (137M/month), cacheable 2.5.1, @cacheable/memory 2.2.1, cache-manager 7.2.10, @cacheable/node-cache 3.1.2, @cacheable/utils 2.5.1, @cacheable/net 2.1.1, and ecto 5.0.1.
That footprint alone puts Shai‑Hulud firmly into “ecosystem‑level incident” territory, with cascading risk across build systems, CLI tooling, and backends that transitively depend on these caching layers.
This campaign is not limited to one maintainer. The Shai‑Hulud worm is actively spreading across npm’s trust graph, jumping into downstream packages and organizations once it lands on a developer machine.
Community telemetry already shows secondary infections in packages maintained by major companies, including @deliveroo/reevent 1.0.1, @or-sdk/invitations 1.4.9, @picsart/ai-sdk 3.32.2, @qlik/embed-runtime 1.6.4, and picasso.js 2.11.6.
As of the latest update on August 4, 2026, at least 868 packages across 1,381 versions have been compromised, amounting to more than 2 billion monthly installs.
The attackers weaponize the npm trust chain: once a developer runs npm install on an infected package, Shai-Hulud harvests tokens, uses them to publish backdoored versions of any other packages the victim controls, and continues cascading across the ecosystem.
Aikido Security stated that each compromised maintainer becomes an unwitting distribution node, complicating traditional dependency audits and incident scoping.
Each compromised package in this wave carries two injected files, setup.mjs and Math_Symbol.js, and a new preinstall script entry (“preinstall”: “node setup.mjs”) in package.json.
This guarantees execution before npm completes the install. setup.mjs functions as a heavily obfuscated dropper whose sole purpose is to silently fetch the Bun JavaScript runtime from GitHub and execute Math_Symbol.js.
Math_Symbol.js is a 728 KB obfuscated payload that turns the victim environment into a credential harvesting node. It scrapes npm tokens from .npmrc files and validates them live against registry.npmjs.org/-/whoami; it hunts GitHub PATs, OAuth tokens, and OIDC JWTs, and even reads GitHub Actions runner memory to steal ID tokens used for npm publishing.
It walks AWS credentials from local files, environment variables, EC2 and ECS metadata, and AWS Secrets Manager, leverages Kubernetes service account tokens to enumerate cluster secrets, and aggressively pulls HashiCorp Vault tokens from multiple locations before dumping all KV secrets.
The payload also scans for Stripe and Slack tokens, SSH keys, cloud storage keys, database connection strings, Terraform state, Docker registry credentials, KeePass databases, VPN configs, and IDE configs using platform‑aware globbing plus regex, skipping large files to maximize coverage.
All findings are encrypted and exfiltrated to public GitHub repositories labeled with “Shai-Hulud: Here We Go Again”, mirroring earlier Shai‑Hulud waves that used similarly named repos as campaign markers and exfil hubs.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
