cyber.hendryadrian.com
Detection & Defense · aikido.dev

Aikido Says Behavior-Based Detection Flagged Obfuscated Keyv Package

· Original article ↗

Summary

Aikido says its behavioral analysis flagged a newly published Keyv version on Aug. 4, 2026, after obfuscated install-time code downloaded Bun and staged another payload; the final payload and any data-theft objective remain unclear.

Key points

  • The article argues that rules based only on strings, hashes, or named indicators can miss attackers who change those artifacts; behavior-based detection can help identify activity that still has to occur.
  • It recommends combining inexpensive signature rules for common, reused threats with more durable behavior- and strategy-level detections.
  • Behavioral rules depend on baselines for normal package activity; expected behavior should be mapped by package type because different kinds of software have different capabilities.
  • Aikido says it flagged a newly published Keyv version on Aug. 4, 2026, whose obfuscated install-time JavaScript downloaded Bun and launched another obfuscated JavaScript file.
  • Aikido says concealed install-time execution, remote binary retrieval, payload staging, and launch supported a high-confidence malware verdict, although the final payload behavior and any data-theft objective were not fully decoded.
  • Aikido describes scanning packages statically and running them in a sandbox to record behavior; the article presents its detection approach and Keyv example as vendor-reported.

Article Details

Defense Focus
Detect malicious software packages that evade known-string and IOC rules by identifying behavior that deviates from package-type baselines.
Detection Methods
  • Statically scan packages and execute them in a sandbox to observe actual behavior.
  • Correlate indicators by the capabilities they represent and compare observed actions with expected behavior for the package type.
  • Look for suspicious combinations such as install-time execution, credential access, outbound data transfer, remote binary retrieval, and payload staging or launch.
Data Sources
  • Static analysis of package code
  • Sandbox observations of package execution, including process activity, filesystem access, credential access, and network behavior
  • Package type and expected behavioral profiles
Rule Types
  • Behavior-based rules combining package capabilities and observed actions
  • String- and IOC-based rules using hashes, named infrastructure, or package names
Defensive Actions
  • Use layered detection: inexpensive string and IOC rules for common reused threats, alongside behavioral rules for threats that rotate indicators.
  • Build and maintain expected-behavior baselines for different package types rather than relying on one universal baseline.
  • Continuously scan application dependencies and investigate unexpected install-time execution, credential access, outbound transfers, or payload retrieval and launch.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe install-time JavaScript and subsequent payload in the Keyv example were heavily obfuscated.T1059.007 · JavaScriptThe malicious Keyv version executed obfuscated JavaScript during installation and then launched another JavaScript file.T1105 · Ingress Tool TransferThe Keyv package behavior included downloading the Bun runtime and retrieving another payload.T1195.001 · Compromise Software Dependencies and Development ToolsThe article describes a malicious newly published Keyv package version and discusses malicious packages in software supply chains.T1567.001 · Exfiltration to Code RepositoryThe article describes stolen secrets packaged as JSON and uploaded to an attacker-created GitHub repository as a package-attack example.

Malware

Shai-HuludA webhook[.]site endpoint and a package named "Shai-Hulud" (the Shai-Hulud npm worm's second wave)

Vendors

AikidoEvery package Aikido Security ingests gets scanned statically and runs in a sandbox that records what it actually did. That part is ordinary. What changed is that an indicator now carries structure beyond the fact that

Products

Aikido IntelSee what we're catching on Aikido Intel. We detect malware in minutes. Connect your repo to Aikido to continuously scan your app dependencies for malicious packages.BunThe setup_bun.js and bun_environment.js files that installed the Bun runtime to run an obfuscated payload in the worm's second wavekeyvOn August 4th 2026, we flagged a newly published version of Keyv, which presented itself as the same popular and trusted key value utility that has been downloaded 600 million times from NPM. This time, however, on

Related Articles