Attackers compromised a GitHub maintainer account associated with multiple npm packages in the keyv/cacheable ecosystem, beginning August 4, 2026. They published malicious package versions embedding a payload derived from the Mini Shai-Hulud malware family, which shares characteristics with TeamPCP and antv campaigns. The malware targets sensitive data such as cloud and developer credentials, AI configuration files, infrastructure secrets, and cryptocurrency wallets. Uniquely, it obtains command-and-control domains from an Ethereum smart contract, allowing dynamic infrastructure updates without altering the payload. Exfiltrated data is sent to GitHub repositories created under compromised identities. Over 400 distinct npm packages were affected, demonstrating advanced supply chain attack techniques focused on developer environments and CI/CD pipelines.

The attack compromises the integrity of widely used npm packages, potentially affecting numerous downstream projects and developers. Sensitive data including cloud credentials, infrastructure secrets, developer credentials, AI configuration files, and cryptocurrency wallets may be stolen. The dynamic retrieval of command-and-control domains from an Ethereum smart contract complicates detection and mitigation. The use of GitHub repositories for data exfiltration under compromised identities further obscures attacker activity. This poses a significant risk to software supply chains and developer environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or advisories are available, developers should audit dependencies in the keyv/cacheable ecosystem and avoid using suspicious or newly published package versions from August 4, 2026, onward. Review GitHub maintainer account security and rotate credentials. Monitor for unusual activity in developer environments and CI/CD pipelines related to these packages. Follow vendor and security community updates for remediation and detection tools.