Supply Chain Compromise Involving keyv and Associated npm Packages

Supply Chain, npm, Credential Theft, Worm, Keyv, Shai-Hulud

Source Material: aikido Blog | Technology: npm, Node.js, CI/CD, GitHub, VS Code, HashiCorp Vault, AWS | Targeted Industries: Agnostic / All Industries

Executive Summary

On August 4, 2026, the primary maintainer behind the keyv and cacheable package ecosystems experienced a supply chain compromise targeting the Node Package Manager (npm) registry. The attack campaign, linked to the “Mini Shai-Hulud” malware family, began when threat actors compromised the GitHub account of the primary maintainer behind the keyv and cacheable package ecosystems. With collective download rates exceeding two billion installations per month, these packages are embedded in many enterprise CI/CD pipelines.

Upon infiltrating the maintainer’s repository, the attackers deployed a weaponized payload leveraging legitimate npm lifecycle hooks to execute code autonomously during package installation. As with earlier “Mini Shai-Hulud” observations, the malware demonstrated autonomous worm capabilities. It scanned infected workstations and CI/CD runners for valid npm publishing tokens, authenticated to the registry, and systematically republished poisoned packages under different organizational namespaces, including major corporate environments.

Exfiltration bypasses standard egress filters by pushing encrypted data to public GitHub repositories disguised as dead drops. Command and Control (C2) relies on Ethereum smart contracts for resilient domain resolution. Finally, the payload installs a punitive local persistence mechanism, a “dead-man’s switch”, designed to execute a destructive secondary handler if incident responders attempt to revoke the compromised credentials prior to eradicating the local persistence files.

Threat Overview and Strategic Impact

The attackers pushed malicious code directly to the primary branch of the legitimate keyv GitHub repository on August 4. The maintainer’s legitimate GitHub Actions workflow built the package and published it to npm with a valid OIDC and SLSA attestation. This subverted cryptographic provenance mechanisms, demonstrating that SLSA guarantees pipeline integrity but does not prevent malicious commits from an authenticated, compromised identity.

The “Mini Shai-Hulud” architecture employs multiple execution triggers. The primary vector exploits npm’s preinstall lifecycle hook (“preinstall”: “node setup.mjs”), executing the malware invisibly before the package installation completes. A secondary, novel vector targets developers who merely inspect the source code. The attackers embedded specific configuration files (.vscode/tasks.json and .claude/settings.json) that automatically trigger the payload when the repository is opened in Visual Studio Code or Anthropic’s Claude Code agent.

Once executed, a dropper (setup.mjs) verifies the presence of the Bun JavaScript runtime, fetching it directly from official GitHub releases if necessary. It then executes the core encrypted payload (Math_Symbol.js). This stage maps the victim’s filesystem, restricting searches to files under 5 MB to prevent memory exhaustion alerts, and targets high-value secret stores. It harvests GitHub classic and OIDC tokens, Kubernetes service account tokens, HashiCorp Vault authentication material, AWS IAM credentials, and local developer secrets (e.g., SSH keys, Terraform states, Stripe API keys). Notably, the malware also targets CI/CD environments by walking /proc to find GitHub Actions Runner.Worker processes and extracting masked secrets from runner memory.

Stolen data is wrapped in RSA-4096 envelope encryption and pushed to freshly generated public GitHub repositories acting as dead drops, using the description “Shai-Hulud: Here We Go Again.” Furthermore, the malware retrieves its command-and-control (C2) domains dynamically by querying an Ethereum smart contract (StringListStore) via public Web3 RPC nodes. This mechanism allows the operators to update C2 infrastructure without modifying the malware, effectively bypassing static DNS blocklists.

The malware propagates autonomously without human intervention. By extracting npm authToken values from local ~/.npmrc files, the worm immediately republishes itself across all namespaces accessible to the stolen token. Within hours, the infection spread from keyv to proprietary packages owned by organizations like Deliveroo, Ornikar, ServiceTitan, and Qlik.

Security Hardening and Recommendations

Due to the worm’s implementation of a dead-man’s switch, remediation requires careful adherence to a specific order of operations.

Isolate Prior to Revocation: Disconnect affected developer workstations or CI/CD runners from the network. Do not reboot, as this may trigger persistence mechanisms. Audit project lockfiles (package-lock.json, yarn.lock, etc.) via dependency tree analysis to identify compromised versions of keyv, flat-cache, file-entry-cache, or downstream infected packages.
Remove the Dead-Man’s Switch: Prior to credential rotation, security teams should verify and remove the local persistence artifacts: ~/Library/LaunchAgents/com.user.gh-token-monitor.plist (macOS) or ~/.config/systemd/user/gh-token-monitor.service (Linux). Gracefully disable these services to prevent the destructive secondary payload from executing when token API access is severed.
Credential Rotation: Once local persistence is eradicated, assume compromise of all exposed secrets. Revoke all GitHub PATs, OAuth tokens, and GitHub App tokens. Invalidate exposed npm publishing tokens. Rotate all AWS IAM keys, Azure service principals, and local developer secrets (SSH, VPN, API keys) residing on the infected host. For Vault and Kubernetes, regenerate the actual secrets stored within the vaults, not just the access tokens.
Pin Dependencies and Scrub Infrastructure: Do not upgrade to “latest” versions, as the worm actively republishes malicious payloads to those tags. Explicitly pin dependencies to pre-August 4 versions (e.g., keyv to 5.6.0). Rebuild lockfiles using the –ignore-scripts flag. Purge all internal artifact repositories (JFrog, Nexus) of the poisoned package versions.

Detection Strategy

Detection efforts should focus on identifying the execution behaviors, file artifacts, and network anomalies generated by the Shai-Hulud malware. Monitor endpoint telemetry for unexpected invocations of the Bun runtime, particularly processes making outbound connections to GitHub release endpoints or Ethereum RPC nodes. File integrity monitoring should alert on the creation of .vscode/tasks.json or .claude/settings.json files containing anomalous workspace execution triggers. Hunt across macOS and Linux fleets to identify the specific gh-token-monitor persistence files, which indicate an active, armed dead-man’s switch on the host.

How Deepwatch Protects Our Customers

Deepwatch experts are continuously monitoring customer environments for indicators and TTPs associated with the Mini Shai-Hulud campaign. Our Threat Intel team is actively collecting and analyzing intelligence on TeamPCP and the ongoing Mini Shai-Hulud campaigns. Our Threat Hunt team periodically hunts in customer environments for signs of malicious or anomalous activity. Detection engineers are constantly monitoring the threat landscape to ensure detection coverage.

Relevant Detections

Please visit the Guardian Platform to access the relevant detections for this activity.

Threat Hunting Leads

Hunt for package.json files within node_modules containing the lifecycle string: “preinstall”: “node setup.mjs”.
Search endpoint telemetry for the creation or modification of directories with highly restrictive 600 permissions at ~/.config/gh-token-monitor/.
Query internal proxy and DNS logs for resolution of the C2 domains: npm-cache[.]com, pypi-get[.]com, or js-mirror[.]com
Review GitHub Enterprise audit logs for repositories created with the description string “Shai-Hulud: Here We Go Again” or commits containing the string “IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients”.
Query endpoint telemetry (EDR/XDR) for any unexpected node processes initiating outbound network connections to `github.com/oven-sh/bun/releases/download/bun-v1.3.13/*` to download the rogue runtime.

Technical Artifacts

Please visit the Guardian Platform to access the associated technical artifacts.

Threat Object Mapping

Intrusion Set:

TeamPCP (Historical association)

Attack Pattern (MITRE ATT&CK/MITRE ATLAS):

Tactic	Technique	Technique ID	Associated Threat Activity
Initial Access	Supply Chain Compromise: Compromise Software Dependencies and Development Tools	T1195.002	Infection of public npm packages via maintainer account takeover.
Execution	Command and Scripting Interpreter: JavaScript	T1059.007	Exploitation of preinstall hooks to run setup.mjs.
Credential Access	Credentials from Password Stores: Credentials In Files	T1555.003	Harvesting tokens from ~/.npmrc, ~/.aws/credentials, and KUBECONFIG.
Exfiltration	Exfiltration Over Alternative Protocol: Symmetric Cryptography	T1048.003	Encrypting stolen secrets and pushing them to public GitHub repositories.
Persistence	Boot or Logon Autostart Execution: Launch Agent	T1543.001	Installing gh-token-monitor.plist on macOS.

Vulnerabilities:

N/A (Relies on legitimate credential compromise and architectural workflows, rather than CVE exploitation).

Malware/Tool:

Mini Shai-Hulud (Worm/Infostealer)
Bun (Legitimate tool utilized as a “bring-your-own-runtime” execution engine)

Move from reactive operations to proactive containment

Cultivating Cyber Resilience Experts

Get access to all the critical information you need to be successful.

Empowering CISOs: Seven Strategies to Outmaneuver Threats for Organizational Resilience

High

CA-26-030: Supply Chain Compromise Involving keyv, cacheable, and Associated npm Packages

By Adversary Tactics and Intelligence Team