Loading story…
Attackers behind Shai-Hulud compromised the maintainer of the widely used npm library keyv and used a self-propagating worm dubbed CHAINDROP to trojanize the keyv monorepo and spread malicious updates across more than 400 npm packages. The campaign abused npm preinstall hooks for code execution, stole developer credentials from infected machines, and automatically republished malicious package versions anywhere stolen npm tokens had write access, including cases where the tokens bypassed 2FA protections. Packages tied to the keyv ecosystem, including flat-cache, cacheable-request, cacheable, and cache-manager, were identified as part of the downstream exposure, raising broad risk across JavaScript build pipelines and dependent applications.
The malware expanded beyond package tampering by implanting Claude Code and VS Code execution hooks and harvesting secrets tied to AI tooling, cloud environments, GitHub, Kubernetes, Vault, SSH, and npm accounts. Elastic Security Labs reported that the operators used an Ethereum smart contract with fallback mechanisms to dynamically resolve exfiltration infrastructure, underscoring a more resilient and automated supply-chain tradecraft. Published guidance urged organizations to revoke GitHub and npm tokens, review repositories for suspicious commits attributed to "claude", rotate exposed secrets, enable npm 2FA, and upgrade to npm 12+ as defenders assess the blast radius of one of the largest recent npm ecosystem compromises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On August 5, 2026, Aikido Security reported that the Shai-Hulud/CHAINDROP campaign had reached 1,381 malicious package versions across 444 npm packages. The report showed the worm had spread beyond the initial keyv-related packages into packages maintained by other organizations.
Wiz Research published additional technical findings on the Keyv/Cacheable supply-chain attack, describing expanded credential-theft targets, updated dead-man-switch logic, a new RSA key for exfiltration, and dynamic C2 retrieval from an Ethereum smart contract that was later updated to return only npm-cache[.]com. Wiz also listed compromised package versions including keyv 6.0.0, @cacheable/utils 2.5.1, cache-manager 7.2.10, and cacheable-request 13.0.20, along with related IOCs.
Elastic Security Labs disclosed additional technical details for the CHAINDROP npm supply-chain campaign, including payload and dropper filenames, hashes, C2 and dead-drop domains, and use of an Ethereum smart contract for exfiltration discovery. The report also said the malware could modify GitHub repositories using stolen GitHub App tokens and plant malicious Claude Code and VS Code configuration files across multiple branches.
On August 4, 2026, Elastic Security Labs identified a new Shai-Hulud supply-chain campaign targeting the maintainer of the widely used npm package keyv. The attackers backdoored the keyv monorepo and embedded the self-propagating CHAINDROP worm to execute via npm preinstall hooks.
OX Security reported the first observed delivery of a Shai-Hulud payload through the official Model Context Protocol Registry, via the V.A.P.E MCP server entry. The linked PyPI package was described as clean, but the associated GitHub repository contained malicious Claude Code and VS Code settings files that triggered credential theft when opened or cloned.
The worm used stolen npm credentials to automatically republish malicious versions of packages for which compromised maintainers had write access and could bypass 2FA. Reporting on the incident states that more than 400 unique npm packages were compromised within hours, creating broad downstream exposure across the JavaScript ecosystem.
Microsoft and Socket said the Mini Shai-Hulud npm supply-chain campaign had grown to 2,234 affected package artifacts spanning 444 unique packages while still spreading. The reporting also described the malware as stealing npm, code-hosting, cloud, and CI/CD credentials and reusing stolen publishing access to republish additional packages.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
16 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcezscaler.com
Open sourceblog.polyswarm.io
Open sourceox.security
Open sourcemalware.news
Open sourcesygnia.co
Open sourceinfosecurity-magazine.com
Open sourceramimac.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers hijacked the GitHub account of maintainer Jared Wray and used legitimate GitHub Actions workflows to publish malicious npm releases for **`keyv`** and multiple **cacheable-family** packages, seeding a supply-chain worm now described as **ChainDrop**, a variant of **Shai-Hulud**. Researchers said the campaign expanded from an initial set of 11 malicious releases to **444 infected packages**, touching dependencies such as **`keyv`**, **`flat-cache`**, and **`cache-manager`** that together see roughly **2 billion monthly downloads**. The poisoned packages carried valid GitHub-signed provenance, but the malicious payload was inserted into npm tarballs and obfuscated `preinstall` paths, allowing the attack to evade checks that rely on source-repository visibility. The malware stole **npm tokens, GitHub credentials, cloud keys, environment variables, shell data, and secrets from memory**, then encrypted and exfiltrated the data after resolving command-and-control infrastructure through an **Ethereum smart contract**. It also planted persistence in repository and IDE configuration files including **`.claude/settings.json`** and **`.vscode/tasks.json`**, meaning simply opening a seeded repository in tools such as VS Code or Claude Code could trigger compromise and further spread. With stolen GitHub access, the worm enumerated repositories and branches, committed malicious configuration files, and installed a revocation-triggered kill switch tied to stolen tokens; defenders were urged to roll back to known-safe versions, inspect branches for unauthorized config changes, remove persistence before revoking credentials, and treat any host that installed affected packages or opened a seeded repository as compromised.
Aug 20, 2026
A supply-chain malware campaign known as **Shai-Hulud** compromised hundreds of packages in the npm ecosystem and later spread into both npm and PyPI, using stolen maintainer credentials and trusted publishing workflows to push trojanized releases. Early reporting said the worm affected more than 500 npm packages, searched infected developer and CI/CD environments for GitHub Personal Access Tokens, cloud API keys, and other secrets, and exfiltrated them to attacker-controlled infrastructure and public GitHub repositories. GitHub removed hundreds of malicious packages, while CISA urged organizations to review dependencies, check for cached malicious packages, rotate credentials, and enforce phishing-resistant MFA for developer accounts. Later waves became more aggressive and broader in scope. Researchers said a second campaign hit hundreds more npm packages and had a blast radius exceeding **27,000 repositories**, abusing `preinstall` and other lifecycle hooks to steal secrets, hijack GitHub Actions, self-propagate into additional packages, and in some cases deploy a conditional wiper-like payload. A subsequent **Mini Shai-Hulud** wave affected more than 170 packages across npm and PyPI, including packages tied to TanStack, Mistral AI, OpenSearch, Guardrails AI, UiPath, and others; it used files such as `router_init.js`, invoked Bun through malicious package scripts, targeted npm, GitHub, cloud, Kubernetes, Vault, and CI/CD credentials, and demonstrated that provenance and OIDC-based trusted publishing can still be abused when attacker-controlled code runs inside legitimate release workflows.
Jun 30, 2026
A software supply chain compromise hit the JavaScript ecosystem after malicious versions of **Keyv** and related npm packages were published through legitimate maintainer workflows, with `keyv@6.0.0` identified as a primary malicious release. Researchers said the tainted packages added a `preinstall` hook that executed attacker code during dependency installation on developer workstations and CI runners, while some repositories also contained malicious **VS Code** and **Claude Code** configuration files that could trigger execution when a cloned project was opened. Early community reports tied the incident to the `jaredwray/cacheable` package set and warned that numerous downstream dependencies were exposed. Analysis found the malware targeted high-value secrets including **GitHub** and **npm** tokens, cloud credentials, Vault tokens, Kubernetes service account tokens, SSH keys, and TLS certificates, with tradecraft resembling the **Shai-Hulud** malware family. Investigators reported no evidence that npm itself was breached; instead, the attackers appear to have used stolen maintainer credentials and trusted GitHub Actions publishing pipelines with valid provenance and npm attestation, demonstrating that provenance verified the build source but not whether the source had already been maliciously altered. Responders were urged to avoid affected versions, isolate any host that installed them, remove persistence such as `gh-token-monitor`, and rotate exposed credentials from a clean system.
Aug 8, 2026