Major Shai Hulud campaign strikes npm again, affecting keyv and 400+ packages

A sophisticated supply-chain attack campaign named Shai-Hulud has compromised over 400 npm packages across 1700+ versions, beginning with keyv and cacheable libraries. The malware operates as a self-propagating worm that collects credentials from local filesystems, CI/CD environments, cloud platforms, Kubernetes clusters, and HashiCorp Vault. It exfiltrates stolen data through dynamic HTTPS endpoints or public GitHub repositories, then uses compromised npm tokens to publish infected versions of all writable packages. The campaign also injects execution hooks into GitHub repositories via VS Code and Claude configuration files, harvests GitHub Actions secrets through injected workflows, and includes a targeted attack against npm trusted publishing flows. Command and control infrastructure leverages Ethereum smart contracts and GitHub commit messages for resilience.

• npm Packages Hijacked in Supply Chain AttackMalware2026-08-04
• Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm PublisherMalware2026-10-26
• Supply Chain Compromise Affecting keyv and cacheable npm PackagesCampaign2026-08-05
• TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackCampaign2026-10-08
• Shai-Hulud Trinitite Hits @7nohe/openapi-react-query-codegenMalware2026-08-31