npm Packages Hijacked in Supply Chain Attack

Multiple npm packages in the keyv/cacheable ecosystem were compromised after attackers gained control of a GitHub maintainer account. Beginning at 9:00 UTC on August 4, 2026, the attacker introduced IDE persistence mechanisms and published malicious versions that propagated to over 400 distinct packages. The payload is a descendant of the 'Mini' Shai-Hulud malware family, sharing similarities with TeamPCP and antv campaigns. It targets sensitive data including cloud credentials, infrastructure secrets, developer credentials, AI configuration files, and cryptocurrency wallets. The malware uniquely retrieves command-and-control domains from an Ethereum smart contract rather than embedding them, allowing infrastructure updates without modifying the payload. Data is exfiltrated through GitHub repositories created under compromised identities. The campaign demonstrates sophisticated supply chain attack techniques targeting developer environments and CI/CD pipelines.

• LiteLLM supply chain compromiseCampaign2026-10-22
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• Black October for AI Developer PlatformsCampaign2026-10-31
• TIKTOUK: Tracing a WordPress Credential Collection ToolkitMalware2026-10-01