npm's Keyv and Cacheable Hijacked in 'Mini Shai-Hulud' Supply-Chain Worm
A hijacked maintainer account let attackers trojan keyv, cacheable-request and flat-cache — reusing the same Shai-Hulud toolkit seen on PyPI and npm earlier in 2026.
Key Takeaways
- On 4 August 2026, attackers took over npm maintainer Jared Wray's GitHub account and published trojanized versions of keyv, cacheable-request, flat-cache and other packages with a combined footprint of over two billion monthly downloads.
- The payload is the third 2026 outbreak of the same Shai-Hulud-lineage toolkit, after April's PyTorch Lightning compromise on PyPI and May's @antv compromise on npm — the attackers reuse infrastructure and file names across ecosystems to blend into normal developer traffic.
- It self-propagates: a preinstall hook harvests npm, GitHub, cloud and Vault credentials, then uses stolen npm tokens to republish more poisoned packages automatically.
- No CVE has been assigned. Because releases went out through npm's legitimate OIDC trusted-publishing flow, the malicious tarballs carried genuine provenance — teams need to rotate credentials and audit for persistence artifacts, not just wait for a patched version.
What happened
On 4 August 2026, an attacker compromised the GitHub account of Jared Wray, maintainer of the widely used npm caching packages keyv and cacheable, and pushed malicious commits that led to trojanized releases including keyv@6.0.0, cacheable-request@13.0.20 and flat-cache@6.1.24. According to Chainguard's analysis, the affected packages carry over two billion combined monthly downloads, and the compromise propagated worm-style into hundreds of additional dependent packages as stolen tokens were reused to publish further poisoned versions.
How the worm spreads
The malicious payload rides in on a preinstall lifecycle script, meaning it can execute the moment a developer or CI runner installs the package — no explicit build step required. Per Chainguard and corroborating detail from Socket's writeup, the script:
- Harvests npm tokens, GitHub tokens (including OIDC-issued ones), AWS keys, Kubernetes service-account tokens and HashiCorp Vault credentials
- Validates stolen npm tokens against the registry's own
whoamiendpoint before using them - Self-propagates by version-bumping and republishing further packages the compromised account can reach
- Downloads a legitimate copy of the Bun JavaScript runtime from GitHub releases to execute later stages, and plants autorun hooks in
.claude/settings.jsonand.vscode/tasks.jsonso tooling can trigger it without a freshnpm install
Why abusing trusted publishing matters
The attacker republished packages through npm's OIDC-based trusted-publishing flow — the CI-driven mechanism designed to replace long-lived publish tokens and give consumers provenance guarantees. Because the compromised account still controlled that pipeline, the poisoned releases came with legitimate-looking attestation attached, which is a reminder that trusted publishing protects against leaked *tokens*, not a fully hijacked maintainer identity.
A reused toolkit, not a one-off
Chainguard ties this to the same Shai-Hulud-derived toolkit behind two earlier 2026 incidents: the PyTorch Lightning compromise on PyPI in April, and the @antv namespace compromise on npm in May. Across all three, researchers found identical hook filenames, matching setup.mjs logic, the same pinned Bun version, and command-and-control resolution via public Ethereum RPC endpoints — a technique that lets malicious traffic look like ordinary blockchain-tooling activity rather than a beacon to a fixed domain. The reuse suggests one operator or toolset cycling through ecosystems rather than independent copycats.
What to do now
- Pin
keyv,cacheable-request,flat-cache,cache-manager,@cacheable/*and related packages to versions predating 4 August 2026, and audit your lockfiles for the malicious versions - Before rotating anything, check
.claude/settings.jsonand.vscode/tasks.jsonfor injected hooks so you don't miss a persistence mechanism - Rotate npm, GitHub (including OIDC/CI), AWS, Kubernetes, database and Vault credentials that any affected build environment could have touched
- Block egress to known campaign infrastructure and review CI/CD and source-control audit logs for unexpected publishes or new repositories
- Run installs with
--ignore-scriptsor on npm 12+ where lifecycle-script behavior is more constrained, while you confirm your dependency tree is clean
Frequently Asked Questions
Is there a CVE for the keyv/cacheable npm attack?
No. As of Chainguard's reporting, no CVE has been assigned to this campaign — treat it as an incident requiring credential rotation and dependency pinning, not a single package upgrade.
What is Shai-Hulud in this context?
It's the name researchers use for a self-propagating npm credential-stealing toolkit whose code and infrastructure have now shown up in three separate 2026 supply-chain compromises: PyTorch Lightning on PyPI, @antv on npm, and now keyv/cacheable on npm.
Does upgrading to a newer keyv version fix this?
Only if you pin to a version published before the 4 August 2026 compromise and rotate any credentials that were exposed to the malicious versions first — installing a newer, unaffected release without rotating tokens leaves stolen credentials valid.