Shai-Hulud Worm Spreads Through Keyv and Hundreds of npm Packages

Summary

Aikido reports that a Shai-Hulud supply-chain worm compromised Keyv and related npm packages, using install scripts to steal credentials and spread through npm packages and GitHub repositories; at least 444 packages were affected.

Key points

Aikido says attackers compromised the GitHub account of the Keyv maintainer on August 4, 2026, then pushed malicious files and released affected package versions.
The report lists affected versions including keyv 6.0.0, flat-cache 6.1.24, and file-entry-cache 11.1.6; it says at least 444 packages across 1,381 versions were compromised.
Affected packages added a preinstall script that ran setup.mjs, which downloaded Bun and launched the obfuscated Math_Symbol.js payload.
The payload targeted npm and GitHub tokens, cloud credentials, Kubernetes secrets, Vault tokens, and other secrets in files and environment variables; on GitHub Actions runners it also attempted to extract runner secrets and OIDC tokens.
Aikido says the payload encrypted harvested credentials and uploaded them to public GitHub repositories, with hxxps://npm-cache[.]com:443/router as a fallback exfiltration endpoint.
The worm used stolen npm tokens to modify and republish packages, and GitHub tokens to add malicious hooks to repository configuration files, including .claude/settings.json and .vscode/tasks.json.
The article reports a combined total of more than 2 billion monthly installs across the affected packages.

Article Details

Attack Vectors: Attackers compromised the keyv maintainer’s GitHub account, pushed malicious files to the main branch, and released poisoned npm package versions with a preinstall script.
The preinstall script downloaded the Bun runtime and used it to execute an obfuscated JavaScript payload that harvested credentials and encrypted them for exfiltration.
The payload used stolen npm tokens to modify and republish packages the token could publish, spreading the worm to additional maintainers’ packages.
With GitHub App tokens, the payload committed malicious hooks to accessible repository branches; the hooks were set to execute when a developer opened the repository in VS Code or started a Claude Code session.
Defensive Notes: The article recommends checking Aikido’s central feed for malware issues and triggering a manual rescan rather than waiting for the nightly rescan.
The article recommends using Aikido Safe Chain to check packages before install commands run.

Indicators of compromise

Type	Indicator	Context
SHA256	`54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668`	SHA-256 of the malicious setup.mjs dropper.
SHA256	`9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc`	SHA-256 of the credential-stealing payload distributed as Math_Symbol.js or math_init.js.
SHA256	`fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb`	SHA-256 of the community-spread version of the malicious setup.mjs dropper.
URL	`hxxps[:]//npm-cache[.]com/router`	Fallback exfiltration endpoint used when uploading encrypted credentials to GitHub fails.