Shai-Hulud npm Worm Returns, Poisoning Over 1,280 npm Packages

Summary

The Shai-Hulud npm worm has resurfaced, compromising over 1,280 npm packages, including the popular Keyv library. Attackers injected malicious code into packages via the legitimate GitHub Actions release process, allowing them to steal npm, GitHub, cloud, and CI credentials in real-time. The malware uses a downloaded Bun runtime to execute obfuscated scripts that exfiltrate sensitive data to a GitHub repository or a specific domain.

Full text

Security Cyber Attacks MalwareShai-Hulud npm Worm Returns, Poisoning Over 1,280 npm Packages Shai-Hulud npm worm spreads through Keyv and hundreds of packages with 2 billion monthly downloads, stealing npm, GitHub, cloud and CI credentials in real time. byDeeba AhmedAugust 4, 20263 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening A fast-moving software supply-chain attack has compromised Keyv and hundreds of other npm packages, exposing developer workstations and continuous integration systems to credential-stealing malware. Aikido Security identified the malware as a Shai-Hulud variant, following earlier campaigns reported by Hackread.com in 2025. Aikido traced the initial attack to the GitHub account of developer Jared Wray, maintainer of Keyv, a key-value storage library receiving roughly 127 million weekly npm downloads. Attackers pushed malicious files directly to the main branch and used the legitimate GitHub Actions release process to publish Keyv version 6.0.0. Because the poisoned release passed through the project’s normal publishing workflow, it carried valid provenance information on npm. The signature verified where the package was built, but not whether the source code entering that process was safe. How the Attack Works The first poisoned releases identified in Wray’s package family included Keyv, flat-cache, file-entry-cache, cacheable-request, cacheable, cache-manager, @cacheable/memory, @cacheable/node-cache, @cacheable/utils, @cacheable/net, and ecto. Each release contained two added files named setup.mjs and Math_Symbol.js. Attackers also inserted the following lifecycle command into package.json: "preinstall": "node setup.mjs" On npm clients that permit dependency lifecycle scripts, installing an affected version causes setup.mjs to execute before installation finishes. However, npm 12 blocks unapproved dependency install scripts by default, so the payload does not run automatically under every npm configuration. Once executed, setup.mjs downloads Bun version 1.3.13 from its official GitHub release page and uses it to launch Math_Symbol.js. The heavily obfuscated 728 KB payload searches for npm authentication tokens, GitHub credentials, AWS keys, Kubernetes secrets, HashiCorp Vault tokens, private keys, database credentials, and tokens belonging to services such as Stripe and Slack. After collecting the information, the malware encrypts it and uploads it to a public GitHub repository whose description contains “Shai-Hulud: Here We Go Again.” If that upload fails, it can send the stolen data to npm-cache(.)com. Screenshot via Aikido Security Worm Reaches Packages Linked to Major Companies By its 13:37 CEST update, Aikido reported at least 868 affected packages involving 1,381 malicious versions. Together, those packages receive more than two billion monthly downloads. The figure describes their combined normal download volume, not two billion infected devices or confirmed malware executions. Using stolen npm and GitHub credentials, the worm modifies and republishes packages available to other maintainers. Aikido researcher Charlie Eriksen later reported that 50 to 100 additional packages were appearing every few minutes, with the observed count passing 1,280. Packages linked to Deliveroo, OneReach, ServiceTitan, Picsart and Qlik appeared in the campaign. Examples included: @deliveroo/reevent version 1.0.1 @or-sdk/invitations version 1.4.9 @picsart/ai-sdk version 3.32.2 @qlik/embed-runtime version 1.6.4 picasso.js version 2.11.6 Their presence shows that package publishing access associated with those names was abused. It does not establish that the companies’ internal networks were breached. What Development Teams Should Do Any workstation or CI runner that executed an affected version should be treated as credential-exposed. Removing the package alone will not invalidate credentials already collected by the malware. Development teams should inspect lockfiles for exact package versions, remove affected releases, rotate npm, GitHub, cloud, and Vault credentials, examine repositories for unauthorized commits, and review cloud logs for unexpected access. Aikido has also advised customers to trigger an immediate manual rescan instead of waiting for the company’s nightly scan. Deeba Ahmed Deeba is a veteran cybersecurity reporter at Hackread.com with over a decade of experience covering cybercrime, vulnerabilities, and security events. Her expertise and in-depth analysis make her a key contributor to the platform’s trusted coverage. View Posts Cyber AttackCybersecurityMalwareNPMShai-huludSupply ChainWorm Leave a Reply Cancel reply View Comments (0) Related Posts Read More Security Microsoft Microsoft Patch Tuesday Oct 2025 Fixs 175 Vulnerabilities including 3 Zero-Days October's Microsoft Patch Tuesday fixes 170+ flaws, including 3 actively exploited zero-days and critical WSUS RCE (CVSS 9.8). Immediate patching is mandatory. Final free updates for Windows 10. byDeeba Ahmed Read More Security Black Hat USA 2024: AWS ‘Bucket Monopoly’ Flaw Led to Account Takeover Black Hat USA 2024 is up and running at full pace as critical AWS vulnerabilities are exposed! Learn… byDeeba Ahmed Read More Security Cyber Crime Malware Phishing Scam Social Media Ducktail Malware Exploits LinkedIn to Hack Facebook Business Accounts Ducktail malware targets users and organizations on Facebook Business and Ads platform in this financially motivated malicious new… byWaqas Read More Security Google News Privacy Technology Google: “Google Hire” Won’t Share Browsing History with Employers Google is known to be in the spotlight for its success mostly, but this wasn’t the case last… byJahanzaib Hassan

Indicators of Compromise

• domain — npm-cache.com
• url — https://github.com/Shai-Hulud-Here-We-Go-Again
• malware — Shai-Hulud

Entities