Press play to start listening
A fast-moving software supply-chain attack has compromised Keyv and hundreds of other npm packages, exposing developer workstations and continuous integration systems to credential-stealing malware. Aikido Security identified the malware as a Shai-Hulud variant, following earlier campaigns reported by Hackread.com in 2025.
Aikido traced the initial attack to the GitHub account of developer Jared Wray, maintainer of Keyv, a key-value storage library receiving roughly 127 million weekly npm downloads. Attackers pushed malicious files directly to the main branch and used the legitimate GitHub Actions release process to publish Keyv version 6.0.0.
Because the poisoned release passed through the project’s normal publishing workflow, it carried valid provenance information on npm. The signature verified where the package was built, but not whether the source code entering that process was safe.
How the Attack Works
The first poisoned releases identified in Wray’s package family included Keyv, flat-cache, file-entry-cache, cacheable-request, cacheable, cache-manager, @cacheable/memory, @cacheable/node-cache, @cacheable/utils, @cacheable/net, and ecto.
Each release contained two added files named setup.mjs and Math_Symbol.js. Attackers also inserted the following lifecycle command into package.json:
"preinstall": "node setup.mjs"
On npm clients that permit dependency lifecycle scripts, installing an affected version causes setup.mjs to execute before installation finishes. However, npm 12 blocks unapproved dependency install scripts by default, so the payload does not run automatically under every npm configuration.
Once executed, setup.mjs downloads Bun version 1.3.13 from its official GitHub release page and uses it to launch Math_Symbol.js. The heavily obfuscated 728 KB payload searches for npm authentication tokens, GitHub credentials, AWS keys, Kubernetes secrets, HashiCorp Vault tokens, private keys, database credentials, and tokens belonging to services such as Stripe and Slack.
After collecting the information, the malware encrypts it and uploads it to a public GitHub repository whose description contains “Shai-Hulud: Here We Go Again.” If that upload fails, it can send the stolen data to npm-cache(.)com.
Worm Reaches Packages Linked to Major Companies
By its 13:37 CEST update, Aikido reported at least 868 affected packages involving 1,381 malicious versions. Together, those packages receive more than two billion monthly downloads. The figure describes their combined normal download volume, not two billion infected devices or confirmed malware executions.
Using stolen npm and GitHub credentials, the worm modifies and republishes packages available to other maintainers. Aikido researcher Charlie Eriksen later reported that 50 to 100 additional packages were appearing every few minutes, with the observed count passing 1,280.
Packages linked to Deliveroo, OneReach, ServiceTitan, Picsart and Qlik appeared in the campaign. Examples included:
@deliveroo/reeventversion 1.0.1@or-sdk/invitationsversion 1.4.9@picsart/ai-sdkversion 3.32.2@qlik/embed-runtimeversion 1.6.4picasso.jsversion 2.11.6
Their presence shows that package publishing access associated with those names was abused. It does not establish that the companies’ internal networks were breached.
What Development Teams Should Do
Any workstation or CI runner that executed an affected version should be treated as credential-exposed. Removing the package alone will not invalidate credentials already collected by the malware.
Development teams should inspect lockfiles for exact package versions, remove affected releases, rotate npm, GitHub, cloud, and Vault credentials, examine repositories for unauthorized commits, and review cloud logs for unexpected access. Aikido has also advised customers to trigger an immediate manual rescan instead of waiting for the company’s nightly scan.
