Do Son 
At a glance
| Malware family | Shai-Hulud variant (“Mini Shai-Hulud”) |
| Threat actor | Unattributed; linked to the Shai-Hulud lineage and prior TeamPCP and antv campaigns |
| Targets | npm and JavaScript developers, plus CI/CD pipelines |
| Delivery vector | Compromised maintainer GitHub account; poisoned npm releases with valid provenance |
| Key capabilities | Theft of npm, GitHub, AWS, Kubernetes, Vault, Stripe, and Slack secrets, plus crypto wallets |
| Source | Aikido; Wiz Research |
TL;DR
Attackers hijacked a maintainer’s GitHub account and poisoned keyv and dozens of related packages on August 4, 2026. This npm supply chain attack plants a credential stealer from the Shai-Hulud family. Keyv alone sees about 127 million weekly downloads, so the exposure is wide.
Delivery
The attacker pushed malicious files to the main branch, then cut fresh releases. As Aikido notes, the poisoned versions reached npm “with valid provenance signed by GitHub Actions.” That signature made the builds look trustworthy. One maintainer owns keyv, cacheable, and flat-cache, so many caching tools fell together. Each package also gained a preinstall hook. Running npm install alone would trigger it.
How the infection chain works
The preinstall hook launches a small dropper. It quietly fetches the Bun runtime, then runs a second-stage stealer named Math_Symbol.js. The stealer hunts secrets across the machine. It reads npm and GitHub tokens, AWS keys, and Kubernetes and Vault credentials. It also grabs Stripe and Slack tokens. A wide filesystem scan chases .env files, private keys, and cloud config. Notably, it targets AI config files too. It validates each stolen token before exfiltration. It then enumerates cloud accounts to widen access.
Command-and-control and exfiltration
Stolen secrets are validated, then sent out. Wiz reports the variant “introduces Ethereum RPC infrastructure as part of its command-and-control.” It also uses a Cloudflare-fronted exfiltration domain. Wiz ties the payload to “a descendant of the Shai-Hulud malware family,” with links to earlier campaigns. Attribution to a named actor is not confirmed. Wiz also found the spread reached beyond the keyv family. Its list names more than 40 poisoned package versions.
Defense and detection
Move fast against this npm supply chain attack. First, remove affected versions from build and CI/CD systems. Then rotate exposed cloud, GitHub, and developer secrets. Wiz urges teams to “treat affected systems as potentially compromised and rebuild them.” Going forward, pin dependencies and verify package provenance. For the full indicator lists, see the Aikido and Wiz write-ups.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
