keyv npm Compromise | Shai-Hulud Worm Hits 400+ Packages

The keyv npm package and its cacheable sibling were hijacked this week in an active supply chain attack that several vendors are calling a "mini Shai-Hulud" event. keyv alone pulls roughly 127 million downloads a week, and the full set of poisoned packages accounts for around 2 billion downloads a month. The malware is a self-propagating worm. It runs during install, steals developer, CI and cloud credentials, then uses any npm tokens it finds to publish trojanized versions of more packages. Multiple trackers put the count at more than 400 affected package versions. If your build pulled keyv or cacheable in the last two days, treat the secrets on that machine as burned.

What happened

On August 4, 2026, security vendors began reporting that packages in the keyv and cacheable namespaces on npm had been republished with malicious code. keyv is a widely used key-value storage abstraction. cacheable is a caching layer built on top of it, and both are published under the same maintainer account. Once that publishing access was abused, the attacker pushed trojanized versions across the maintainer's packages and their dependents.

Socket, Aikido, Snyk, Wiz, Cloudsmith and Kodem put out near-simultaneous advisories. The working theory across those reports is that this is a smaller, targeted rerun of the Shai-Hulud worm that hit npm in September and November 2025. Phoenix Security labeled it "mini Shai-Hulud." No CVE has been assigned as of this writing.

The scope numbers vary by source. Safedep counted keyv, cacheable and 400+ other packages. Gridinsoft put the figure at 444 poisoned packages. The blast radius is large because keyv sits deep in the dependency trees of caching, ORM and framework libraries, so many teams carry it transitively without ever listing it directly.

Timeline

• September 2025: The original Shai-Hulud worm compromises hundreds of npm packages and exfiltrates secrets to public GitHub repositories.
• November 2025: A second wave, tracked as Shai-Hulud 2.0, hits packages with billions of combined downloads.
• Early 2026: Follow-on "mini" campaigns target AI developer tooling and individual maintainers.
• August 4, 2026: keyv and cacheable versions carrying the worm appear on npm. Vendors publish their first advisories within hours.
• August 5, 2026: IOC lists and response runbooks circulate, and npm begins removing the malicious versions.

The exact publish timestamps of the bad versions are still being reconstructed, so treat the window as August 4 onward until a vendor confirms tighter bounds.

Who is affected

Anyone who installed or reinstalled keyv, cacheable, or related packages during the window is potentially affected. Because the worm runs during install, a CI pipeline that ran npm install or npm ci against an unpinned range could have executed the payload with no human in the loop.

keyv's reach is the real problem. It is a transitive dependency of many popular libraries, so plenty of projects have it in node_modules without adding it on purpose. If your lockfile floated to a compromised version, you inherited the malware.

The stolen data, per the advisories, includes npm tokens, GitHub personal access tokens, and cloud provider credentials (AWS, GCP, Azure) found in the environment. CI runners are prime targets because they hold exactly those secrets.

How the attack works

The mechanics follow the Shai-Hulud playbook. Snyk's analysis describes a preinstall script that runs before the package is wired into your project. Executing at install time means the code runs on developer laptops and CI runners alike, with whatever permissions that process holds.

Once running, the payload scans the environment and filesystem for secrets. Prior Shai-Hulud waves used TruffleHog-style scanning to find tokens and keys. It then does two things: exfiltrate the loot, and spread. With any valid npm token it recovers, the worm publishes trojanized versions of other packages the compromised account can write to. That self-propagation is what makes this a worm rather than a one-off package compromise.

Two details set this wave apart. First, researchers report the malware abuses npm's trusted provenance signals, so a poisoned build can still look like it came from a legitimate pipeline. Second, and more unusual, the worm plants persistence hooks in developer tooling. The Hacker News and Snyk report that it writes hooks for Claude Code and Visual Studio Code, so the malicious logic can re-trigger inside the developer's editor and AI coding assistant after the first install.

How to check if you are affected

Start with your lockfile and installed tree. Run this on every repo and CI image built in the last few days.

# List every resolved version of the affected packages
npm ls keyv cacheable cacheable-request @keyv/redis @keyv/mongo

# Grep the lockfile directly
grep -nE '"(keyv|cacheable|cacheable-request|@keyv/)' package-lock.json

Look for install scripts that should not be there:

# Find preinstall/postinstall scripts in the dependency tree
find node_modules -name package.json -maxdepth 3 \
  -exec grep -l -E '"(pre|post)install"' {} \;

Check for the editor and AI-assistant persistence that researchers flagged:

# VS Code and Claude Code hook locations to inspect
ls -la .vscode/ 2>/dev/null
grep -R "preinstall" ~/.claude 2>/dev/null

On the GitHub side, look for repositories or workflow files you did not create. Prior Shai-Hulud waves exfiltrated to freshly created public repos under victim accounts, so audit your org for unexpected public repos and new entries under .github/workflows.

Remediation

Assume credential compromise first and cleanup second. Rotation is the part that actually stops the bleeding.

1. Rotate everything the build could see: npm tokens, GitHub PATs and app tokens, and all cloud keys. Do this from a machine you know is clean.

# Revoke and reissue npm tokens
npm token list
npm token revoke <token-id>

2. Pin away from the bad versions. Remove the compromised range from your lockfile and reinstall against known-good releases once npm confirms clean versions.

# Reinstall strictly from a vetted lockfile, no install scripts
npm ci --ignore-scripts

3. Wipe and rebuild caches. Delete node_modules and any npm cache on CI runners, then rebuild from a pinned, script-free install.

rm -rf node_modules
npm cache clean --force

4. Turn on npm's install-script blocking and require 2FA for publishing. Blocking lifecycle scripts by default removes the entire preinstall foothold this worm relies on.

5. Hunt for persistence. Remove any unexpected VS Code or Claude Code hooks, and delete rogue GitHub workflows or public repos the worm may have created.

If you cannot confirm which version ran, treat the secrets as exposed and rotate anyway. That is far cheaper than a breach investigation.

Context

This did not happen in isolation. npm's advisory feed logged dozens of other malicious packages the same day, including crypto-wallet credential stealers published under the @zzzgenesis00 namespace such as @zzzgenesis00/ethers-wallet and @zzzgenesis00/spl-token-utils. Those are separate campaigns, but they show the current volume of npm abuse. The keyv incident stands out because of reach and the self-propagating design.

FAQ

Is keyv safe to use?

The package itself is legitimate and widely used. The problem is specific compromised versions published during the attack window. Once npm removes the malicious versions and the maintainer confirms clean releases, keyv is fine to use again on a pinned, vetted version. Until you have rotated any secrets that could have been exposed, do not trust builds that pulled the bad versions.

How do I know if I am affected by the keyv Shai-Hulud worm?

Check your lockfile and installed tree for the affected keyv and cacheable versions, look for unexpected preinstall or postinstall scripts, and audit your GitHub org for new public repos or workflow files. If any CI job ran npm install against an unpinned range in the last two days, assume exposure and rotate credentials.

What is Shai-Hulud?

Shai-Hulud is a self-replicating npm worm first seen in September 2025. It runs during package install, steals developer and CI credentials, exfiltrates them to attacker-controlled locations, and uses any npm tokens it finds to publish trojanized versions of more packages. This keyv wave is a smaller, targeted variant that several vendors are calling "mini Shai-Hulud."

Does a CVE exist for this attack?

No CVE had been assigned as of August 5, 2026. Compromises like this are usually tracked through vendor advisories and npm security holds rather than a CVE, because the issue is malicious published versions rather than a code defect. Follow the IOC lists from Socket, Aikido, Snyk and Kodem for version-level detail.