Shai-Hulud Strikes Again: The npm Worm That Infected 400+ Packages in Hours
If you’re a developer, npm install is muscle memory. It’s the quiet background process that keeps projects moving. On August 4, 2026,that same command became a high-stakes liability.
In one of the most aggressive and sophisticated software supply chain attacks the npm ecosystem has seen, attackers hijacked the GitHub account of maintainer Jared Wray (jaredwray) and used it to poison core caching ibraries including keyv, cacheable, flat-cache, file-entry-cache,and more than 400 other packages. These libraries sit deep in dependency trees—often as transitive dependencies of everyday tools like ESLint—and together account for well over 2 billion monthly installs.
This wasn’t a simple malware drop. It was a self-propagating worm from the Shai-Hulud family (specifically a “Mini” variant,sometimes tracked as ChainDrop or “Here We Go Again”). Here’s exactly what happened, how it works, and what you need to do right now.
The Breach: When Trusted Provenance Lies
The attack began early on August 4. Attackers compromised the legitimate GitHub account controlling the keyv and cacheable package family. Instead of quietly swapping code in isolation, they pushed malicious changes directly to the main branch and immediately triggered releases through the existing GitHub Actions workflows.
Because the poisoned packages were built and published via the real maintainer’s CI, they carried valid software provenance and SLSA attestations signed by GitHub Actions. Signature checks and many automated security tools saw nothing wrong. It was the ultimate Trojan horse: the malware arrived wearing a perfect digital seal of approval.
keyv@6.0.0 went live around 09:35 UTC. Within roughly an hour the worm had already republished malicious versions across multiple organizations. By later that day, researchers (Aikido, Wiz, Socket, and others)were tracking 400–800+ unique packages and 1,300–2,200+ malicious versions,with the count still climbing in some reports.
How the Shai-Hulud Worm Works
The moment an affected package is installed—whether by a developer laptop or a CI runner—a hidden preinstall script fires before your application code ever runs.
A small loader (setup.mjs) downloads a standalone Bun runtime and executes a roughly 700–728 KB second-stage payload (Math_Symbol.jsor the near-identical math_init.js in later infections). The payload is heavily obfuscated and platform-aware.
It doesn’t stop at a one-time theft. It plants persistence hooks in:
- .vscode/tasks.json (triggered on folder open)
- .claude/settings.json (triggered on AI coding assistant session start)
These hooks mean the malware can re-execute the next time you open the project in VS Code or spin up a Claude Code (or similar)session—no second npm install required.
The worm then uses any stolen npm publish tokens to automatically infect other packages the victim controls, bumping the patch version, injecting the same preinstall hook and payload files, and republishing. This is what turned a single maintainer compromise into a cascading, multi-organization outbreak that hit packages tied to companies including Deliveroo, Qlik, Picsart, ServiceTitan, and others.
What Was Stolen? (Spoiler: Nearly Everything)
This was a highly advanced, multi-target credential harvester. It actively searched for:
- Cloud & infrastructure: AWS (credentials files, env vars, instance metadata, Secrets Manager), GCP, Azure, Kubernetes service account tokens and secrets, HashiCorp Vault tokens (multiple auth methods)
- Developer & CI keys: npm auth tokens, GitHub classic PATs, OAuth tokens, GitHub App tokens, and OIDC tokens (including direct dumps from GitHub Actions runner process memory)
- Third-party APIs: Stripe keys, Slack tokens
- Local secrets: Extensive filesystem scans (~200 patterns) for .env files, SSH keys, TLS private keys, password manager databases (*.kdbx), Terraform state, Docker configs, VPN files, and more
Stolen data is encrypted with AES-256-GCM under an attacker-controlled key and exfiltrated primarily to public GitHub repositories whose descriptions read “Shai-Hulud: Here We Go Again.” A fallback C2 domain(npm-cache.com) is retrieved dynamically from an Ethereum smart contract,allowing the operators to rotate infrastructure without updating the payload.
Your Immediate Action Plan
If any machine or CI runner ran npm install (or equivalent)on or after August 4 and pulled an affected version of the keyv/cacheable family or downstream packages, treat it as fully compromised.
1. Isolate first Disconnect affected developer machines and CI runners from the network.
2. Hunt for the hooks and residual malware Inspect .vscode/tasks.json and .claude/settings.json for unexpected entries. Look for residual monitoring scripts (e.g., gh-token-monitor) in launch agents, systemd user services, or similar locations
3. Rotate credentials from a clean device only Rotate everything: GitHub PATs and OIDC, npm tokens, AWS/GCP/Azure keys, Vault tokens, Kubernetes secrets, database credentials, Stripe/Slack keys, SSH keys, etc. Do not rotate from a compromised machine—the malware actively monitors for revocation attempts.
4. Purge registries and rebuild Scrub internal proxies, mirrors, and artifact caches of any August 4 releases of the affected packages. Pin to known-good prior versions (e.g., keyv 5.6.0 or the 6.0.0-rc.1 candidate where applicable). Rebuild CI runners and developer environments from clean images.
5. Audit lockfiles and dependency trees Search lockfiles for the malicious versions. Treat any package that received a sudden patch-level bump on August 4 with extreme suspicion until verified
The Bigger Lesson
We build the future on open source. That trust is powerful—and increasingly fragile. Valid provenance and digital signatures are necessary but no longer sufficient when the attacker controls the legitimate release pipeline.
Assume compromise if you interacted with these packages on August 4. Lock down environments, rotate keys from clean systems, and stay vigilant. The worm is designed to keep moving; your response needs to be faster.
