Keyv and friends compromised in active Shai-Hulud supply chain attack

On August 4, 2026, a cyberattack targeted the GitHub account of a maintainer behind the popular keyv library, which has approximately 127 million weekly downloads on npm. The attacker injected a credential-stealing worm into the package family, affecting other widely-used caching utilities such as cacheable, flat-cache, and file-entry-cache.

The malicious files were pushed directly to the main branch and released, carrying the signature of GitHub Actions. Within hours, the compromised packages were spread to other maintainers and widespread community adoption. The worm added setup.mjs and Math_Symbol.js files to each package, along with a preinstall script. When npm install was executed, setup.mjs executed first, downloading a Bun JavaScript runtime and subsequently executing the Math_Symbol.js file.

This file contained credential stealers that harvested secrets, encrypted them, and exfiltrated them to a public GitHub repository named "Shai-Hulud: Here We Go Again." The payload could target various secret stores, including ~/.npmrc, environment variables, Kubernetes secrets, and Stripe/API keys. The stolen credentials were used to infect other packages and maintainers, with each infected package republished with modified tarballs.