The threat involves a large, obfuscated JavaScript payload embedded in the compromised [email protected] npm package, identified as a newer variant of Shai-Hulud malware. It performs four main malicious activities: harvesting credentials from various environments including local machines, continuous integration systems, cloud platforms, Kubernetes clusters, and Vault secrets; exfiltrating stolen data through dynamically generated HTTPS endpoints or public GitHub repositories; leveraging stolen npm credentials to publish infected patch releases to other npm packages; and exploiting GitHub credentials via GitHub Actions workflows to further compromise repositories and extract additional credentials. The attack demonstrates a comprehensive supply chain compromise targeting developer tools and infrastructure, with multiple components such as obfuscated JavaScript files, VS Code configuration files, and injected GitHub Actions workflows facilitating credential theft and lateral movement.

This malware campaign enables attackers to steal sensitive credentials across multiple environments including local systems, CI/CD pipelines, cloud platforms, Kubernetes, and Vault secrets. The stolen credentials can be used to exfiltrate data, propagate malicious code through npm package updates, and compromise GitHub repositories via GitHub Actions workflows. This can lead to widespread supply chain compromise affecting multiple packages and development environments, potentially exposing sensitive organizational secrets and infrastructure access.

No official patch or remediation guidance is provided in the available data. Organizations should verify the integrity of the keyv package version 6.0.0 and audit their npm dependencies for compromise. Review and rotate credentials potentially exposed in local, CI, cloud, Kubernetes, and Vault environments. Inspect GitHub repositories for unauthorized GitHub Actions workflows and remove any injected malicious workflows. Monitor for suspicious npm package updates and consider using package integrity verification tools. Patch status is not yet confirmed — check vendor advisories and trusted security sources for updates.