Mini Shai-Hulud keyv/cacheable npm Compromise (No CVE Assigned): Self-Propagating Worm Steals CI, Cloud, and Developer Credentials

Executive Summary

On August 4, 2026, an attacker took over the GitHub account behind keyv and the broader cacheable family of caching libraries, then published keyv@6.0.0 carrying a malicious preinstall hook. The payload is a variant of Mini Shai-Hulud, a self-propagating npm worm that steals credentials and then uses whatever publishing tokens it finds to poison more packages. Within roughly half an hour the same payload appeared across nine unrelated organizations, and by the end of the day multiple trackers were counting well over a thousand poisoned package versions.

Operationally, this matters because of where these packages sit. keyv pulls around 127 million weekly downloads, and two of the compromised siblings, flat-cache and file-entry-cache, live underneath ESLint. Most teams never chose to depend on them. They arrived transitively through a linter almost everyone runs, which is exactly why the exposure surface is so wide. Any workstation or CI runner that installed an affected version, or that opened a clone of the poisoned repository in VS Code or Claude Code, should be treated as credential-exposed until proven otherwise.

If the payload runs, it harvests npm, GitHub, AWS, GCP, Azure, Kubernetes, HashiCorp Vault, Stripe, and Slack secrets, reads GitHub Actions runner process memory to lift OIDC publishing tokens, and exfiltrates the collected material to attacker-controlled public GitHub repositories described “Shai-Hulud: Here We Go Again.” It also plants a watcher that fires when a stolen GitHub token is revoked, which inverts the normal incident-response reflex and makes response ordering a real operational concern. There is no CVE for this incident, and provenance signatures on the poisoned releases were valid, so neither a CVE feed nor an SLSA badge would have flagged it.

https://phxintel.security/malware.html?campaign=mini-shai-hulud-keyv-cacheable-npm-compromise#mp-list-view

TL;DR for Engineering Teams

What it is: A software supply-chain compromise of the keyv/cacheable npm maintainer account that shipped a Mini Shai-Hulud credential-stealing worm. No CVE assigned. Severity is critical in practice (Aikido scores the malware 100/100).

Where it bites: npm installs of affected versions across developer machines and CI/CD runners, plus a second path that executes when the poisoned repository is opened in a trusted VS Code or Claude Code workspace. flat-cache and file-entry-cache reach most teams transitively through ESLint.

Why it spread: The worm harvests npm publishing tokens and republishes itself into other maintainers’ packages automatically. Poisoned releases shipped with valid GitHub Actions OIDC and SLSA provenance, so they passed integrity checks that rely on signing rather than source review.

Patch status: No patch, because there is no code flaw to fix. Malicious versions have largely been unpublished and npm latest tags rolled back to clean releases. Remediation is version pinning, credential rotation, and host rebuilds.

Immediate action: Pin keyv to 5.6.0 (or 6.0.0-rc.1 if you need the v6 API), remove the credential-revocation watcher before rotating anything, then rotate every token reachable from an exposed host and rebuild affected machines.

Full shai hulud campaign tracker: https://sha1-hulud-monitoring.pplx.app

Vulnerability Overview

Technical Anatomy

Root Cause Analysis

The failure is trust in a maintainer credential, not a bug in the caching code. The attacker gained control of the jaredwray GitHub account, pushed the malicious files directly to main, and immediately cut a release. Because keyv releases run through a legitimate GitHub Actions trusted-publisher workflow over OIDC, the poisoned tarballs shipped to npm with genuine SLSA provenance pointing at the real release workflow and the v6.0.0 tag.

That provenance is the subtle part. SafeDep documented that the commit planting the IDE hooks even carried a green GitHub-verified badge with its author field spoofed to github-actions[bot]. GitHub signs commits created through its API and web UI with its own key while letting the caller supply the author as free text, so a write-capable credential can manufacture a “verified” bot commit. The provenance chain proved the build pipeline was legitimate. It could not prove the source entering that pipeline was safe, and it says nothing about who held the credential. This is the recurring lesson of the 2026 Shai-Hulud waves, and it is why CVE-based and signature-based controls have no detection surface here.

Exploit Path

1. Entry point. The attacker pushes setup.mjs, Math_Symbol.js, a “preinstall”: “node setup.mjs” line, and repo-resident .claude/.vscode hook files to main, then triggers the release workflow. Poisoned versions publish to npm with valid provenance. A telltale preinstall.test.ts added alongside the payload was deleted 21 minutes later.

2. Trigger. On npm install, the preinstall script runs node setup.mjs, an obfuscated dropper. It checks for the Bun runtime and, if absent, downloads the legitimate Bun v1.3.13 from github.com/oven-sh/bun/releases/download/bun-v1.3.13/, executes the real payload through it, then deletes the runtime. The only install-time network egress is to GitHub, so reputation-based egress monitoring stays quiet.

3. Impact. The 727,680-byte Math_Symbol.js bundle harvests secrets from the environment, encrypts them, and exfiltrates to attacker-created public GitHub repositories described “Shai-Hulud: Here We Go Again,” with npm-cache[.]com:443/router as a fallback channel. It then uses any npm publishing token it recovered to inject itself into other packages, increment their versions, and republish, which is what turns a single compromise into a worm.

Second Execution Path (No Install Required)

The repository itself carries a trap for anyone who clones it to inspect the code. Its .claude/settings.json holds a SessionStart hook and its .vscode/tasks.json holds an Environment Setup task with runOn: folderOpen, cross-wired so each config invokes the other directory’s script. Opening the checkout in Claude Code or VS Code can run the payload. VS Code blocks automatic tasks in an untrusted workspace and prompts before allowing them, and Claude Code applies workspace trust to repository-supplied settings, so these conditions reduce the risk rather than removing it. The keyv repo carried thousands of stars, so the population of people who cloned it to read the source after disclosure is not small.

What It Steals

The payload runs a set of targeted extractors: npm tokens from ~/.npmrc (validated live against registry.npmjs.org/-/whoami), GitHub PATs, OAuth, App, and OIDC tokens (including a read of GitHub Actions runner process memory for ACTIONS_ID_TOKEN_REQUEST_TOKEN and _URL), AWS credentials via files, environment variables, IMDSv2 with an IMDSv1 fallback at 169.254.169.254, ECS metadata at 169.254.170.2, and Secrets Manager enumeration, Kubernetes service-account tokens with direct API secret reads, HashiCorp Vault tokens with full KV v1 and v2 enumeration, and Stripe and Slack tokens. A platform-aware scanner then runs roughly 200 glob patterns for .env files, private keys, SSH material, Terraform state, Docker credentials, KeePass databases, and VPN configs.

Dead-Man’s Switch

The payload installs a watcher that executes an attacker-supplied local handler the moment the stolen GitHub token is revoked. SafeDep’s guidance is explicit and worth repeating in your runbook: hunt and remove the watcher first, then rotate, because revocation is the trigger. Community scanners describe a destructive handler in related TeamPCP waves; treat that specific behavior as reported in-family rather than independently confirmed for this sample, whose string table SafeDep left partly undecoded.

Campaign Timeline

One evolution is specific to this variant: Wiz observed Ethereum RPC infrastructure used as part of command and control, which had not appeared in prior waves.

Affected Versions

Confirmed maintainer-family packages (“Publisher A”). Poisoned releases have largely been unpublished and tags rolled back.

Worm-spread packages across unrelated organizations (non-exhaustive, tags moved rapidly): the full @ornikar/* set (Wiz enumerates roughly 30 versions), @qlik/embed-react 2.5.3, @qlik/embed-runtime 1.6.4, @qlik/embed-web-components 1.7.3, @qlik/runtime-module-loader 1.5.1, @nebula.js/nucleus 0.5.1, @deliveroo/reevent 1.0.1, the @or-sdk/* set, @arv-bedrock/*, @picsart/ai-sdk 3.32.2, @hubsync/web-sdk-react 6.3.7, and picasso.js / picasso-plugin-* 2.11.6.

VERIFY: The brief’s @qlik/api@2.14.2 and the “17+ @servicetitan/* packages (eslint-config, anvil-themes, table, form, log-service)” both trace primarily to Microsoft’s public post. SafeDep separately confirmed @qlik/api@2.14.2 was published by qlikossbuild; the specific @servicetitan/* sub-package names could not be corroborated against a second primary source. Treat both the @qlik/api and @qlik/embed-* sets as in scope.

Caveat that overrides the table: latest tags changed during the incident and some sibling packages stayed clean, including the published @keyv/* adapters and the keyv 5.x line. A namespace blocklist risks both missing poisoned versions and quarantining safe releases. Match exact resolved versions against your lockfiles.

Exposure Analysis

Real-World Impact

The reach here is a transitive-dependency problem more than a direct-dependency one. keyv sees around 127 million weekly downloads, and Aikido put flat-cache and file-entry-cache at roughly 565 million and 557 million downloads per month, most of that arriving through ESLint rather than through anything a developer added on purpose. Aikido estimated combined exposure at more than two billion monthly installs across at least 868 packages and 1,381 versions, and SafeDep counted 546 public “Shai-Hulud: Here We Go Again” exfiltration repositories created on August 4 alone.

Read those numbers carefully. They count malicious artifacts and attacker dead-drops, not victim systems. The counts also diverged between vendors and moved in real time as tags rolled back, and no vendor could reproduce a complete package-by-package list. They establish campaign magnitude. They do not tell you how many machines actually installed and executed the payload, which depends entirely on the exact version resolved on each host and whether its lifecycle script ran.

Realistic attack scenarios follow directly from what the payload collects: npm account takeover leading to onward package poisoning, cloud credential theft through IMDS and Secrets Manager, full CI/CD pipeline compromise through runner memory and OIDC token theft, and secret extraction from Vault and Kubernetes namespaces.

Detection Guidance

Log and Host Indicators

Look for npm install, or a child process, spawning a download to github.com/oven-sh/bun, the user-agent Bun/1.3.13, and artifacts under /tmp/bun-dl-*/ or a node_modules/keyv/Math_Symbol.js file. Watch for outbound traffic to npm-cache[.]com on :443/router and to the Ethereum RPC hosts used for C2. Flag new or unexpected .claude/settings.json, .vscode/tasks.json, setup.mjs, or Math_Symbol.js / math_init.js files in repositories or node_modules, and any .vscode task labeled “Environment Setup” with runOn: folderOpen. Search your org for public GitHub repositories described “Shai-Hulud: Here We Go Again” and for the marker string IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients. A GitHub Actions workflow that dumps ${{ toJSON(secrets) }} to a build artifact is another strong signal.

Consolidated IOCs

No SHA-1 IOCs could be verified from reachable primary sources. Wiz publishes hash and version tables in its wiz-sec-public/wiz-research-iocs repository; pull those directly if you need the SHA-1 set.

Scanner References

Aikido surfaces this as a 100/100 malware issue and supports manual rescans, and its open-source Safe Chain intercepts installs against a threat feed. SafeDep’s vet evaluates install hooks as a CI policy gate. Socket decoded the self-propagation machinery. Wiz maintains the affected-package and IOC feed. Validate any community scanner’s IOC list against a primary source before you trust it.

Verification Steps

1. Grep lockfiles, including transitive resolutions, for each affected package and version, for example grep -rn “keyv” package-lock.json pnpm-lock.yaml yarn.lock | grep “6\.0\.0”.
2. Find repository checkouts touched during the window with find . -path “*/.vscode/tasks.json” -newermt “2026-08-04”, and inspect .claude/ and .vscode/ for unexpected setup.mjs.
3. Match file hashes against the SHA-256 IOCs above rather than trusting latest tags or provenance signatures.
4. In CI, audit any pipeline run that touched these packages during the window, and check for unexpected releases of your own packages and for injected workflows dumping toJSON(secrets).

Remediation

Immediate Actions

1. Do not install keyv@6.0.0 or any malicious version in the tables above. Pin keyv to 5.6.0, or to 6.0.0-rc.1 if you need the v6 API. Restore clean targets across the family, including flat-cache@6.1.23 and cache-manager@7.2.9.
2. Do not open a clone of the poisoned repository in VS Code or Claude Code.
3. Revoke the publishing credential and disable the release workflow before you clean the tree. The 09:39 staging commit means a routine release cut from main would re-ship the payload across the whole @keyv scope.
4. Hunt and remove the token-revocation watcher first, then rotate npm, GitHub PAT and App, AWS, GCP, Azure, Vault, Kubernetes service-account, SSH, Stripe, and Slack credentials reachable from any exposed host. Rebuild affected machines, delete node_modules, and clear the npm cache. Treat any CI pipeline that ran an install in the window as credential-exposed.

Temporary Mitigations

Move to npm 12, which blocks unapproved dependency lifecycle scripts by default. Understand its limit before you rely on it: npm 12, like –ignore-scripts, stops the preinstall-hook delivery path but not runtime-code variants and not the .claude / .vscode IDE-hook path, which execute outside npm entirely. Blanket-approving scripts through approve-scripts erases the benefit. Pin exact versions rather than ranges, add install-time policy gating in CI, enforce MFA on maintainer accounts, and adopt trusted publishing with a staged, human-approved publish step so a stolen token cannot cut a silent release.

Phoenix Security Recommendations

Phoenix Security closes the gap that CVE-based and signature-based tooling leaves open in this class of attack, because there is no CVE and the signatures were valid. Phoenix matches resolved lockfile versions against the reconciled affected-version set instead of relying on namespace blocklists or provenance, correlates the result with runtime workloads and internet-exposed services through attack surface management, and prioritizes CI/CD assets and any service whose build reached these packages during the window as credential-exposed. From there it drives remediation campaigns with assigned owners and staged rotation runbooks that sequence watcher-removal before token rotation, a non-obvious step most generic playbooks get wrong.

Behavioral detection is what actually catches the next wave. Phoenix supports standing supply-chain rules that a vulnerability feed cannot express: alerting when a package adds or changes a preinstall, postinstall, or prepare script between versions, when an install-time process contacts github.com/oven-sh/bun or any non-registry host, when a published tarball diverges from its source tree, and when unexpected .claude, .vscode, or setup.mjs artifacts or “Shai-Hulud: Here We Go Again” dead-drop repositories appear under your org. The lifecycle-script delta rule alone would have caught every Shai-Hulud wave to date.

External References

1. Wiz Research, “keyv and cacheable npm Package Hijacked in Supply Chain Attack” (Aug 4, 2026).
2. Aikido Security, “Keyv and friends compromised in active Shai-Hulud supply chain attack” (Aug 4, 2026).
3. SafeDep, “keyv 6.0.0 Compromised With an Install Hook and an IDE Auto-Run Hook” (Aug 4, 2026).
4. The Hacker News, “Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks” (Aug 4, 2026).
5. Socket Security research on the self-propagation and republish machinery (Aug 4, 2026).
6. Semgrep documentation of the April PyTorch Lightning PyPI compromise sharing the same .claude/.vscode hooks, setup.mjs, and Bun 1.3.13 dropper.
7. Microsoft Threat Intelligence public advisory referencing the Trojan:npm/MalBun.A Defender detection (VERIFY: single-sourced).
8. Wiz IOC repository: github.com/wiz-sec-public/wiz-research-iocs.

The data behind this article is available in full in the Phoenix Security Supply Chain Intelligence Report

Read the Full Supply Chain Intelligence Report