Shai-Hulud Worm Compromises 868 npm Packages With 2 Billion Monthly Installs

The Shai-Hulud supply chain worm has escalated again, compromising at least 868 npm packages with a combined total of over 2 billion monthly installs. Researchers at Aikido Security say the attack is still actively spreading, with 50 to 100 new packages infected every few minutes.

On August 4, 2026, attackers took over the GitHub account of jaredwray, the maintainer behind keyv, a key-value storage library with roughly 127 million weekly downloads on npm. With valid maintainer access, they pushed malicious commits directly to the main branch and immediately cut new releases — ensuring the poisoned versions were published with legitimate GitHub Actions provenance signatures.

🔍 THE BOTTOM LINE

This is not a single package compromise. The Shai-Hulud worm is designed to spread. Every developer who runs npm install on an infected package becomes a new distribution node. Their credentials are stolen, used to publish backdoored versions of any other packages they control, and the cycle continues. The number of compromised packages grew from 868 to over 1,280 within hours of the initial report.

How It Spreads

The same maintainer controls nine high-volume caching packages, all pulled into the blast radius:

• keyv 6.0.0 — ~604M installs/month
• flat-cache 6.1.24 — ~580M/month
• file-entry-cache 11.1.6 — ~571M/month
• cacheable-request 13.0.20 — ~137M/month
• cacheable 2.5.1, @cacheable/memory 2.2.1, cache-manager 7.2.10, and others

Each compromised package carries two injected files — setup.mjs and Math_Symbol.js — and a new preinstall script entry in package.json. This guarantees execution before npm completes the install.

setup.mjs is a heavily obfuscated dropper that silently downloads the Bun JavaScript runtime from GitHub and uses it to execute Math_Symbol.js, a 728 KB obfuscated payload that turns the victim’s environment into a credential harvesting node.

What It Steals

The payload scrapes credentials from across the victim’s system:

• npm tokens from .npmrc files, validated live against registry.npmjs.org/-/whoami
• GitHub PATs, OAuth tokens, and OIDC JWTs — including reading GitHub Actions runner memory to steal ID tokens used for npm publishing
• AWS credentials from local files, environment variables, EC2 and ECS metadata, and AWS Secrets Manager
• Kubernetes service account tokens to enumerate cluster secrets
• HashiCorp Vault tokens from multiple locations
• Stripe and Slack tokens
• SSH keys, cloud storage keys, database connection strings, Terraform state, Docker registry credentials, KeePass databases, VPN configs, and IDE configs

All findings are encrypted and exfiltrated to public GitHub repositories labelled “Shai-Hulud: Here We Go Again” — a callback to the earlier Shai-Hulud campaigns that hit PyTorch Lightning in May 2026.

Companies Already Hit

The worm has spread beyond the initial maintainer’s packages into packages maintained by major companies:

• Deliveroo (@deliveroo/reevent 1.0.1)
• Picsart (@picsart/ai-sdk 3.32.2) — AI-powered photo and video editing platform
• Qlik (@qlik/embed-runtime 1.6.4) — business intelligence and data integration
• ServiceTitan — cloud-based field service management software
• OneReach — AI orchestration and automation platform

The Trust Problem

The attack exploits a fundamental weakness in the npm ecosystem: a single compromised maintainer account can cascade across thousands of downstream packages. The malicious versions were published with valid GitHub Actions provenance signatures, meaning standard supply chain verification tools would not flag them.

As Aikido Security stated, each compromised maintainer becomes an unwitting distribution node, complicating traditional dependency audits and incident scoping. The worm’s design means the attack surface grows exponentially — not linearly — with each new infection.

Kiran Raj, security researcher at Endor Labs, wrote that “the pattern is consistent across them: an npm publishing token was stolen and used to push malicious versions, in most cases a CI or service-account token likely harvested from a build runner that had itself installed a poisoned dependency.”

NZ Angle

New Zealand’s software development community relies heavily on the npm ecosystem. Any NZ company running npm install in the past 48 hours may have pulled compromised packages. Developers should:

1. Check if any installed packages match the compromised versions listed above
2. Rotate all credentials that may have been exposed: npm tokens, GitHub PATs, AWS keys, Kubernetes secrets, Vault tokens
3. Audit CI/CD pipelines for signs of unauthorised package publishing
4. Consider pinning dependencies to known-good versions rather than using latest

The broader issue for NZ: the country’s tech sector depends on open source infrastructure maintained by individuals. One compromised GitHub account in another country can cascade into NZ build systems within hours. There is no NZ-specific mitigation for a global supply chain attack — the fix has to come from the ecosystem level.

❓ FAQ

What is Shai-Hulud? A credential-stealing worm that targets the npm ecosystem. Named after the sandworm from Dune. First seen in late 2025, it has resurfaced multiple times in 2026 targeting PyPI and npm packages.

How do I know if I’m affected? Check your node_modules and lockfiles for the compromised package versions listed above. If you’ve run npm install recently, check your npm and GitHub tokens for unauthorised use.

What should I do if I’m affected? Rotate all credentials immediately — npm tokens, GitHub PATs, AWS keys, Kubernetes secrets, Vault tokens, Slack/Stripe tokens. Revoke and regenerate. Audit your published packages for unauthorised versions.

Is this the same as the PyTorch attack? Same worm, different target. The May 2026 attack hit PyTorch Lightning on PyPI. This attack targets npm packages and is significantly larger in scope.

How is it still spreading? The worm steals npm publishing tokens from infected developers, then uses those tokens to publish malicious versions of any packages the victim maintains. Each new victim becomes a new distribution node.

📰 Sources

• Aikido Security — Keyv and friends compromised
• CyberPress — Shai-Hulud npm worm compromises 868 packages
• DevOps.com — Fast-moving Shai-Hulud attack infects npm packages
• eSecurity Planet — GitHub account breach fuels Shai-Hulud attack

---

— CJ Murden, editor of Singularity.Kiwi. Former digital technologies teacher, author of AI-focused books. Writing with a New Zealand focus.