A compromised release of the `keyv` npm package, published at 09:35 UTC on August 4, 2026, spread a credential-stealing worm across over 400 distinct npm packages within roughly 30 minutes, according to Wiz.
Quick Summary – TLDR:
- Attackers published a malicious `keyv@6.0.0` release and 10 related packages, per Snyk, after compromising a maintainer account on GitHub.
- A hidden `preinstall` script deployed a 727,680-byte payload that harvests GitHub tokens, cloud credentials, private keys, and database connection strings.
- The repository also planted persistence hooks inside Claude Code and VS Code that only trigger if a developer trusts the workspace, The Hacker News found.
- The malicious release still carried valid npm attestation and GitHub Actions trusted-publisher credentials, passing the standard signing checks.
- Pre-incident downloads for the affected packages topped 619,682,667 for `keyv` alone in the month before the compromise, per Snyk.
What Happened?
The npm package keyv, a widely used key-value storage library, shipped a modified `package.json` adding `”preinstall“: “node setup.mjs“` to version 6.0.0. That loader fetched a 727,680-byte second-stage payload named `Math_Symbol.js`, which Snyk’s analysis found performs platform checks for Linux, macOS, and Windows, use of child_process.execFileSync, filesystem operations, HTTPS access, and Bun runtime handling. It is the same class of dependency-poisoning trick that hit AWS CodeBuild, which risked a JavaScript SDK used by about 66% of cloud environments.
The same attacker published 10 related packages in the `cacheable` family, including `@cacheable/net`, `cache-manager`, and `file-entry-cache`. The worm then republished itself into other organizations’ packages every 2 to 7 minutes, completing its cross-organization burst in roughly half an hour.
Beyond npm’s own install hooks, Wiz Research traced the intrusion to a compromised GitHub maintainer account used to inject IDE persistence payloads into the keyv repository starting around 09:00 UTC. The repository’s `.claude/settings.json` carried a `SessionStart` hook, and `.vscode/tasks.json` carried a `folderOpen` task, each pointing at a setup script in the other tool’s directory. Both require the developer, or an autonomous coding agent, to trust the workspace first: VS Code blocks automatic tasks in untrusted workspaces by default, and Claude Code applies its own workspace trust restrictions.
‼️ BREAKING: An active npm supply chain attack has compromised at least 868 packages carrying over 2 billion monthly installs with a credential-stealing worm. Shai-Hulud is back.
— International Cyber Digest (@IntCyberDigest) August 4, 2026
It started with the compromise of the GitHub account of the maintainer behind keyv, a library with… pic.twitter.com/OpaAa64w8i
Signed and Verified, But Not Safe
The malicious release passed the checks teams normally rely on to trust a dependency:
- The commit author identity showed as `github-actions[bot]` carrying a verified GitHub signature.
- The release carried valid OIDC and SLSA provenance through keyv’s own GitHub Actions workflow.
- Snyk read that combination as evidence of compromise of an account, credential, session, or release path rather than an unauthorized outside maintainer inserting code by hand.
That distinction matters more than it sounds. Provenance attestation proves a release came out of the pipeline it claims to, not that the pipeline itself is clean. A compromised maintainer token satisfies every automated trust check a supply-chain scanner runs.
Security firms’ scale estimates diverged sharply as the incident unfolded, a normal feature of real-time worm telemetry rather than a discrepancy in the underlying attack. SafeDep’s initial count of 353 poisoned versions across 79 package names later grew to 1,684 versions across 420 names, while Socket estimated 442 versions across 353 names and Aikido counted at least 868 packages across 1,381 versions. Wiz’s own tally put the damage at over 400 distinct npm packages.
Wiz attributed the payload to a descendant of the ‘Mini’ Shai-Hulud malware family, tying it to earlier TeamPCP and antv supply-chain campaigns. Stolen data was exfiltrated to GitHub repositories created under compromised identities, using the description “Shai-Hulud: Here We Go Again“, and the malware’s command-and-control layer used an Ethereum smart contract to retrieve domains dynamically instead of relying on hardcoded infrastructure.
npm’s own response was partial in the first hours. The registry removed three malicious versions between 10:39 and 11:11 UTC, but eight malicious releases were still tagged “latest” in Snyk’s 11:16 UTC snapshot. The gap fits a wider pattern tracked in Cybersecurity Jobs: 55% of cybersecurity teams report being understaffed, and 65% have unfilled roles, a shortfall that slows exactly the kind of rapid, cross-registry cleanup this worm demanded.
What’s Next?
Pin known-clean versions such as `keyv@5.6.0` and `flat-cache@6.1.23`, then reinstall with lifecycle scripts disabled. From there, sequence carefully: hunt for and disable the malware’s `gh-token-monitor` persistence mechanism before rotating credentials, since rotating first can trip the malware’s own credential-revocation watcher. npm 12 and later block unapproved dependency lifecycle scripts by default, but earlier versions remain exposed to the same `preinstall` trick this worm used.
Coding-agent workflows carry a related exposure worth auditing alongside npm hooks. Cymulate researchers separately disclosed a command-injection flaw in Claude’s coding assistant, CVE-2025-54795, reachable through whitelisted commands such as echo, pwd, and whoami, via Claude AI Command Injection Vulnerabilities, a reminder that the trust boundary around coding-agent workspaces is an active target well beyond this one worm.
On the defensive side, vendors shipping multi-platform client software are shifting from point-in-time scans to continuous composition monitoring. Return-to-China VPN operator QuickFox partnered with Murphy Security in September 2026 to run software composition identification, supply chain poisoning detection, and license compliance checks across its Windows, macOS, Android, iOS, and TV clients.
SQ Magazine’s Takeaway
One compromised maintainer credential reached over 400 packages in a single August 2026 morning. A `preinstall` hook used to mean a risky install script. Here, it meant a Bun-compiled binary hunting for GitHub tokens, Kubernetes secrets, and cloud keys, wrapped in attestation that made the release look routine to every automated scanner checking for it.
The IDE hooks are the detail that helps reduce any sense that this is over once the bad versions are unpublished. A workspace trust prompt has not historically carried much weight as a security boundary, and coding agents that auto-approve trust to save a click widen exactly the path this worm tried to open. Closing that gap means auditing install scripts and workspace trust settings alongside pinning clean package versions, not settling for the version pin alone.
