VTA-000195 – Shai – Hulud Supply Chain Worm Compromises Over 400 npm Packages Reaching 2 Billion Monthly Downloads

On August 4, 2026, attackers successfully compromised the GitHub account of a prominent npm maintainer responsible for keyv, a widely-used key-value storage library with approximately 127 million weekly downloads. The breach extended across the maintainer's entire package portfolio, including flat-cache, file-entry-cache, cacheable-request, and cache-manager, collectively representing over 2 billion monthly installations. The attackers pushed malicious code directly to the main branch of each repository and immediately cut new releases, ensuring the poisoned versions were published to npm with valid GitHub Actions provenance signatures. Within hours, the malware demonstrated worm-like propagation capabilities, spreading to at least 434 packages across 1,381 versions through community infection, including packages maintained by major organizations such as Deliveroo, Qlik, and Picsart.

The attack operates through a two-stage payload delivery mechanism that executes automatically during package installation. Each compromised package received a preinstall script that triggers setup.mjs, a heavily obfuscated dropper designed to silently download the Bun JavaScript runtime and execute the primary payload, Math_Symbol.js, a 728 KB credential harvester. This payload implements comprehensive credential extraction targeting npm authentication tokens, GitHub personal access tokens and OIDC tokens, AWS credentials from multiple sources including EC2 metadata services and Secrets Manager, Kubernetes service account tokens and secrets, HashiCorp Vault tokens through six different authentication methods, and Stripe and Slack API keys. The malware performs platform-aware filesystem scanning using approximately 200 glob patterns to locate environment files, private keys, SSH credentials, Terraform state files, Docker registry credentials, KeePass databases, and VPN configurations. All harvested credentials are encrypted using RSA before exfiltration to approximately 1,300 public GitHub repositories identified by the description string "Shai-Hulud: Here We Go Again", with a fallback to a command-and-control domain dynamically retrieved from an Ethereum smart contract.

This incident represents one of the most sophisticated and impactful supply chain attacks in the npm ecosystem to date, combining account compromise, automated propagation, and multi-platform credential theft. The worm functionality actively uses stolen npm tokens to identify and infect additional packages by fetching current tarballs, injecting malicious preinstall scripts and payload files, incrementing version numbers, and republishing to the registry. Second-generation infections are identifiable by the presence of math_init.js rather than Math_Symbol.js, indicating community spread beyond the original compromise. Organizations that installed any affected package versions between the initial compromise and current remediation efforts should assume credential exposure across npm, GitHub, AWS, Kubernetes, and Vault environments. Immediate response actions include rotating all npm publishing tokens, GitHub PATs and Actions secrets, AWS access keys, Kubernetes service account tokens, and Vault tokens for any systems that executed npm install during the compromise window.

Severity:

High

Attack Surface:

Supply Chain (Third-party vendors), Endpoint, Cloud Service, Infrastructure

Tactics:

Initial Access, Execution, Persistence, Credential Access, Collection, Exfiltration, Lateral Movement

Techniques:

T1195.002 – Supply Chain Compromise: Compromise Software Supply Chain

T1059.007 – Command and Scripting Interpreter: JavaScript

T1552.001 – Unsecured Credentials: Credentials In Files

T1552.005 – Unsecured Credentials: Cloud Instance Metadata API

T1555 – Credentials from Password Stores

T1078.004 – Valid Accounts: Cloud Accounts

T1567.001 – Exfiltration Over Web Service: Exfiltration to Code Repository

T1027 – Obfuscated Files or Information

T1071.001 – Application Layer Protocol: Web Protocols

T1082 – System Information Discovery

T1497.001 – Virtualization/Sandbox Evasion: System Checks

References:

1. https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack

SuperPRO’s Threat Countermeasures Procedures:

1. Immediately remove compromised package versions: keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable-request 13.0.20, cacheable 2.5.1, cache-manager 7.2.10, and all packages listed in the Aikido advisory. Audit package-lock.json and yarn.lock for any affected versions.

2. Rotate all npm authentication tokens for any developer or CI/CD system that ran npm install between August 4, 2026 00:00 UTC and remediation completion. Revoke tokens via npm token revoke or through the npm web interface.

3. Rotate GitHub personal access tokens, OAuth tokens, and GitHub App tokens. Reset ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL secrets in all GitHub Actions workflows that publish to npm.

4. Rotate AWS credentials including access keys, secret keys, and session tokens for any EC2 instances, ECS containers, or developer workstations exposed during the compromise window. Enumerate and rotate all secrets stored in AWS Secrets Manager across all regions.

5. Rotate Kubernetes service account tokens and recreate all secrets in namespaces where compromised packages were installed. Review and revoke any unauthorized API access discovered through Kubernetes audit logs.

6. Rotate HashiCorp Vault tokens and review audit logs for unauthorized secret enumeration via /v1/sys/mounts or KV read operations. Revoke any tokens generated through AWS IAM or Kubernetes authentication methods during the exposure period.

7. Scan filesystem for presence of setup.mjs, Math_Symbol.js, or math_init.js files. Alert on preinstall script executions that download external binaries, particularly Bun runtime from github.com/oven-sh/bun/releases. Monitor outbound connections to npm-cache.com domain and GitHub repositories with description containing 'Shai-Hulud: Here We Go Again'.

Contributed by: Tasneem Amelia