A quick-moving software program supply-chain assault has compromised Keyv and lots of of different npm packages, exposing developer workstations and steady integration techniques to credential-stealing malware. Aikido Safety recognized the malware as a Shai-Hulud variant, following earlier campaigns reported by Hackread.com in 2025.
Aikido traced the preliminary assault to the GitHub account of developer Jared Wray, maintainer of Keyv, a key-value storage library receiving roughly 127 million weekly npm downloads. Attackers pushed malicious recordsdata on to the principle department and used the legit GitHub Actions launch course of to publish Keyv model 6.0.0.
As a result of the poisoned launch handed via the challenge’s regular publishing workflow, it carried legitimate provenance data on npm. The signature verified the place the bundle was constructed, however not whether or not the supply code getting into that course of was secure.
How the Assault Works
The primary poisoned releases recognized in Wray’s bundle household included Keyv, flat-cache, file-entry-cache, cacheable-request, cacheable, cache-manager, @cacheable/reminiscence, @cacheable/node-cache, @cacheable/utils, @cacheable/web, and ecto.
Every launch contained two added recordsdata named setup.mjs and Math_Symbol.js. Attackers additionally inserted the next lifecycle command into bundle.json:
"preinstall": "node setup.mjs"
On npm shoppers that let dependency lifecycle scripts, putting in an affected model causes setup.mjs to execute earlier than set up finishes. Nonetheless, npm 12 blocks unapproved dependency set up scripts by default, so the payload doesn’t run routinely below each npm configuration.
As soon as executed, setup.mjs downloads Bun model 1.3.13 from its official GitHub launch web page and makes use of it to launch Math_Symbol.js. The closely obfuscated 728 KB payload searches for npm authentication tokens, GitHub credentials, AWS keys, Kubernetes secrets and techniques, HashiCorp Vault tokens, non-public keys, database credentials, and tokens belonging to companies corresponding to Stripe and Slack.
After accumulating the knowledge, the malware encrypts it and uploads it to a public GitHub repository whose description incorporates “Shai-Hulud: Right here We Go Once more.” If that add fails, it might probably ship the stolen information to npm-cache(.)com.
Worm Reaches Packages Linked to Main Firms
By its 13:37 CEST replace, Aikido reported no less than 868 affected packages involving 1,381 malicious variations. Collectively, these packages obtain greater than two billion month-to-month downloads. The determine describes their mixed regular obtain quantity, not two billion contaminated units or confirmed malware executions.
Utilizing stolen npm and GitHub credentials, the worm modifies and republishes packages out there to different maintainers. Aikido researcher Charlie Eriksen later reported that fifty to 100 extra packages had been showing each couple of minutes, with the noticed depend passing 1,280.
Packages linked to Deliveroo, OneReach, ServiceTitan, Picsart and Qlik appeared within the marketing campaign. Examples included:
@deliveroo/reeventmodel 1.0.1@or-sdk/invitesmodel 1.4.9@picsart/ai-sdkmodel 3.32.2@qlik/embed-runtimemodel 1.6.4picasso.jsmodel 2.11.6
Their presence exhibits that bundle publishing entry related to these names was abused. It doesn’t set up that the businesses’ inner networks had been breached.
What Improvement Groups Ought to Do
Any workstation or CI runner that executed an affected model must be handled as credential-exposed. Eradicating the bundle alone won’t invalidate credentials already collected by the malware.
Improvement groups ought to examine lockfiles for actual bundle variations, take away affected releases, rotate npm, GitHub, cloud, and Vault credentials, look at repositories for unauthorized commits, and assessment cloud logs for surprising entry. Aikido has additionally suggested prospects to set off an instantaneous handbook rescan as an alternative of ready for the corporate’s nightly scan.
