DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 4 Aug 2026Updated 17 Aug 2026443 packages · 2235 versions

keyv / cacheable family hijacked in Shai-Hulud "Here We Go Again" worm

Summary

On 2026-08-04 a compromised maintainer account pushed a preinstall credential stealer into the keyv / cacheable family and the worm spread via stolen npm tokens across ~2B monthly installs. Releases were cut from main, so npm signed them with valid provenance. Verified count as of the Wiz IOC feed: 443 npm packages across 2,235 versions; SafeDep's registry-backed telemetry puts the total at 1,684 versions across 420 names tied to nine orgs.

wormmaintainer-takeoveraccount-takeovercredential-theftci-cd-compromisecrypto-wallet-drainobfuscation
Detected by
Aikido Security · Wiz · Datadog Security Labs · SafeDep · Snyk · Socket
Also known as
Shai-Hulud: Here We Go Again · keyv/cacheable compromise
Ecosystems
npm
Packages tracked
443

What happened

Refreshed 2026-08-17. The verified package list is now the full Wiz Research IOC feed (keyv-packages.csv): 443 npm packages spanning 2,235 versions across the compromised maintainers keyv/cacheable (11 pkgs), @ornikar/* (42), Qlik @nebula.js/*+@qlik/*+picasso.js/sn-listbox/etc. (58), OneReach @onereach/*+@or-sdk/* (152), ServiceTitan @servicetitan/*+verdaccio-*+folder-lint-style tooling (149), @hubsync/web-sdk-react (27 versions), @arv-bedrock/* (5), plus @adminide-stack/*, @picsart/*, @thiennq/*, @umacloud/*+umadev, @workbench-stack/*+workbench-browser-server, @deliveroo/*, frontend-orb, native-frontend-orb, babel-plugin-linaria-css-to-undefined, pob-test-*, rwc-client, server-hemera-mongo. SafeDep's independent registry-backed telemetry puts the total higher (1,684 versions across 420 names tied to 9 orgs); the Wiz CSV is used here because every row is a checked package@version pair. Datadog Security Labs' write-up, Snyk's "Inside the keyv npm Supply Chain Compromise" (03aug-preinstall-malware-trusted-provenance-ide-hooks), and Socket's tracking blog all corroborate the same worm.

On 2026-08-04 an attacker took over the GitHub account of the maintainer behind keyv and the wider cacheable family, then pushed malicious files directly to main and immediately cut releases. Because the releases were built by the project's own GitHub Actions workflow, npm published them with valid provenance attestations. This is the detail worth internalising: provenance attests where a build came from, not that the code is safe. Every automated check that trusts provenance as a proxy for integrity passed these packages.

Every affected package received two new files - setup.mjs and Math_Symbol.js - plus a "preinstall": "node setup.mjs" entry in package.json. setup.mjs is a heavily obfuscated dropper whose only job is to silently download the Bun runtime (v1.3.13) from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ into /tmp/bun-dl-*/ and execute the real payload under it. Math_Symbol.js is a 728 KB obfuscated blob containing the credential stealers. Running with --ignore-scripts blocks it; a normal npm install does not.

The stealer harvests npm auth tokens from .npmrc, GitHub CLI tokens (classic PATs, session tokens, OIDC), AWS keys from ~/.aws/credentials, and Vault tokens from VAULT_TOKEN. Wiz additionally observed cloud and infrastructure secrets, AI tool configuration files, cryptocurrency wallets, CI/CD secret harvesting, build-runner identification, and cloud environment enumeration. Findings are encrypted and exfiltrated into public GitHub repositories created under compromised identities, carrying the description Shai-Hulud: Here We Go Again. Wiz also found the payload planting IDE persistence - setup.mjs written into .claude and .vscode directories - which survives a plain dependency cleanup.

The stolen npm tokens feed the worm. Registry timestamps show how fast it moved: keyv@6.0.0 landed at 09:35:00 UTC, the first onward hop (@thiennq/docs-viewer@1.6.2) at 09:38:13 - three minutes later. The rest of the cacheable family went out between 10:10 and 10:15, then 25 @ornikar/* packages were published in a single second at 10:19:10, and a Qlik cluster (@qlik/*, @nebula.js/nucleus, picasso*, http-metrics-middleware) at 10:46:36. By 11:37 UTC Aikido counted 868 packages across 1,381 versions with over 2 billion combined monthly installs. The package list below is the verified subset published by Aikido and Wiz, not the full 868.

Wiz assesses the payload as a descendant of the "Mini" Shai-Hulud family, sharing similarities with the TeamPCP TanStack burst and the @antv wave, and notes a new intimidation string in the initial commits: IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients. Attribution remains open - Wiz Research is still investigating and has not named an actor, so none is recorded here.

Verification notes

Every package@version below was checked against the live npm registry while compiling this entry. All ten packages in the maintainer's own family (keyv, cacheable, cache-manager, cacheable-request, flat-cache, file-entry-cache, @cacheable/*, ecto) had exactly one version published on 2026-08-04, and npm has since removed all ten. The worm-propagated versions were still live at time of writing and each independently confirmed to carry "preinstall": "node setup.mjs". Note that @or-sdk/invitations shipped three poisoned releases (1.4.8, 1.4.9, 1.4.10) - 1.4.10 at 11:55 UTC looks like a remediation attempt but still carries the hook. @picsart/ai-sdk@3.32.1 was checked and is clean; only 3.32.2 is affected.

Indicators of compromise

  • Exfil domain: npm-cache[.]com (104.21.35[.]216, Cloudflare)
  • ETH RPC endpoints: eth-mainnet.nodereal[.]io, go.getblock[.]io, eth.llamarpc[.]com
  • File artifacts: /tmp/bun-dl-*/, node_modules/keyv/Math_Symbol.js
  • Math_Symbol.js / math_init.js - SHA1 35a672cf34b996b91f3e1c28cbf3a05a37e036e4
  • setup.mjs in .claude - SHA1 686aa40d0fc22c8d569494543a0f891f359f2f99
  • setup.mjs in .vscode - SHA1 f525d52ceb966516686b482d3dc0137028cc6a63
  • GitHub repo description: Shai-Hulud: Here We Go Again

Affected packages (443)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.json

Impact

  • npm registry auth tokens harvested from .npmrc - used to publish the worm onward
  • GitHub CLI tokens: classic PATs, session tokens, and OIDC tokens
  • AWS access keys and session tokens from ~/.aws/credentials
  • HashiCorp Vault client tokens from VAULT_TOKEN, with an HTTP fallback fetch
  • Cloud/infra secrets, AI tool configuration files, and cryptocurrency wallets
  • CI/CD secrets, build-runner identification, and cloud environment enumeration
  • IDE persistence: setup.mjs dropped into .claude and .vscode so the payload re-runs after cleanup
  • Exfiltration to attacker-created public GitHub repos described Shai-Hulud: Here We Go Again

What to do

  1. 1Pin away from every version listed below and reinstall with --ignore-scripts; the hook is preinstall, so it fires before install completes
  2. 2Audit lockfiles for the exact versions - keyv@6.0.0, flat-cache@6.1.24, file-entry-cache@11.1.6 are the highest-blast-radius entries
  3. 3Treat any machine or runner that installed an affected version as compromised and rebuild it
  4. 4Rotate npm tokens, GitHub PATs/OIDC trust, AWS keys, Vault tokens, SSH keys, Kubernetes and Terraform credentials
  5. 5Audit your own npm publish history - stolen tokens were used to push the worm under unrelated maintainers
  6. 6Delete stray setup.mjs / Math_Symbol.js / math_init.js from repos and from .claude and .vscode directories
  7. 7Search for exfil repos under your GitHub org with the description Shai-Hulud: Here We Go Again and revoke their creating tokens
  8. 8Do not treat npm provenance as a safety signal here - these builds were genuinely signed by GitHub Actions

References

Back to feedSubmit a correction
npm-2026-08-04-shai-hulud-keyv-cacheable