Mini Shai-Hulud: the keyv and cacheable attack hits packages with over 2 billion monthly downloads

2026-08-04 · Publisher : npm · Domain : Cloud & DevOps

On 4 August 2026, after the hijacking of its maintainer's GitHub account, about ten npm packages of the keyv and cacheable family are booby-trapped by a credential-stealing worm, which spreads to hundreds more packages.

What changes

  • The maintainer's GitHub account for keyv is hijacked on 4 August 2026.
  • Eleven packages are directly hit, including keyv, flat-cache and file-entry-cache, at over 570 million monthly downloads each.
  • The worm steals tokens, cloud keys, Kubernetes and Vault secrets, then spreads to hundreds of packages.
  • npm 12 blocks unapproved install scripts by default.

### Background On 4 August 2026, an attacker takes over the GitHub account of the maintainer of keyv and cacheable, pushes malicious code directly to the main branch then publishes new versions of packages in the family. Chainguard sees it as the third known wave, in 2026, of the Shai-Hulud toolkit lineage, after PyTorch Lightning (April) and the @antv ecosystem (May); the campaign is nicknamed "Mini Shai-Hulud". ### Key facts - Aikido counts 11 directly affected packages, including keyv (604 million monthly downloads), flat-cache (580 million) and file-entry-cache (571 million). - The worm then spreads to several hundred packages, for over 2 billion cumulative monthly downloads (Aikido and Chainguard). - It downloads the Bun runtime, then steals npm and GitHub tokens, AWS keys, Kubernetes secrets, Vault tokens and SSH keys; encrypted data goes to the attacker's GitHub repositories. - The initial access vector remains unknown according to Chainguard. - Measures: roll back to clean versions, use npm install --ignore-scripts; npm 12 and later block unapproved lifecycle scripts by default. ### Why it matters A year after Shai-Hulud, the technique remains effective, including on widely used infrastructure libraries present in almost every Node.js project. The attack also shows the value of the platform protections introduced since: no install scripts by default and a cooling-off delay shrink the exposure window. Teams that have not moved to npm 12 or enabled these safeguards remain exposed. ### Takeaway The worm returns on a core dependency: npm 12 safeguards and the cooling-off delay become the default defence.

Links

Tags : Sécurité, CI/CD, Open Source, DevOps