Aikido Security says an npm supply chain attack has infected Keyv packages with a variant of the credential-stealing Shai-Hulud malware. The security firm reports that attackers have compromised the GitHub account of jaredwray, the maintainer of the Keyv key-value storage library.
The attackers pushed malicious code to the main branch, then cut releases through GitHub Actions. That release path gave the poisoned npm versions valid GitHub Actions provenance. The malware runs before an affected package installation completes.
Aikido initially identified the attack across the maintainer’s package family, including Keyv, cacheable, cache-manager, cacheable-request, flat-cache, and file-entry-cache. Its supplied package list names 10 entries, including ecto, although the initial disclosure refers to nine packages.
The download volume is substantial. Aikido puts flat-cache at 565 million monthly downloads and file-entry-cache at 557 million; Keyv records roughly 127 million weekly downloads in the disclosure.
A preinstall script delivers the payload
Each affected package received two added files: setup.mjs and Math_Symbol.js. Attackers also inserted a preinstall script into package.json:
“preinstall”: “node setup.mjs”
That command executes setup.mjs when a user runs npm install against an affected release. The installation process invokes the script before it completes.
The dropper then downloads the Bun JavaScript runtime from a GitHub release URL for Bun v1.3.13. It uses that runtime to execute Math_Symbol.js, a heavily obfuscated JavaScript file that Aikido describes as 728 KB in size.
setup.mjs calls Bun through execFileSync, with the downloaded binary running the payload from the script directory. This avoids placing the main credential-stealing logic directly inside the preinstall file.
The second file contains the credential collectors, encryption routines, exfiltration code, and package-propagation functions. Aikido says the malware sends stolen data to a public GitHub repository whose description reads: “Shai-Hulud: Here We Go Again”.
The attack has spread beyond the Keyv maintainer
Aikido describes the malware as a variant of Shai-Hulud, with worm-like behaviour that targets packages owned by other maintainers who have installed an infected dependency. The source says the research team saw 50–100 newly infected packages every few minutes.
An update timestamped 4 August 2026 at 13:37 CEST reports at least 868 compromised packages across 1,381 versions. Those versions accounted for more than two billion monthly installs at the time Aikido wrote the update.
The differing package totals reflect the pace of the reported spread. Aikido’s figures describe a live incident rather than a completed package inventory.
Several packages under corporate npm scopes appear in the supplied data. They include @deliveroo/reevent version 1.0.1, @or-sdk/invitations version 1.4.9, and @picsart/ai-sdk version 3.32.2. The list also names @qlik/embed-runtime 1.6.4 and picasso.js 2.11.6.
For organisations using npm in build pipelines, the infection point sits in dependency installation. A developer workstation, a continuous integration runner, or a deployment environment can execute the preinstall script if its lockfile or dependency range resolves to a compromised version.
Valid package provenance doesn’t prevent that execution. GitHub Actions signed releases from a compromised maintainer account still appear to originate from the expected publishing process.
Credential theft reaches local and cloud environments
Math_Symbol.js reads npm authentication material from ~/.npmrc and searches the filesystem for other .npmrc files. It extracts authToken values, plus registry-specific _authToken entries, then validates tokens against npm’s /-/whoami endpoint before exfiltration.
GitHub credentials form another target set. The code searches for classic personal access tokens with the ghp_ prefix, OAuth tokens beginning gho_, GitHub App tokens beginning ghs_, and JWT OIDC tokens.
On GitHub Actions runners, Aikido says the payload reads runner process memory to obtain the secret store. It also targets ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL, environment values used to request OIDC tokens for tasks such as npm publishing.
AWS access receives similar treatment. The malware reads ~/.aws/credentials and ~/.aws/config, then checks environment variables including AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.
It also probes the EC2 Instance Metadata Service at 169.254.169.254, trying IMDSv2 before falling back to IMDSv1. ECS metadata at 169.254.170.2 falls within the collection logic.
The payload calls secretsmanager:ListSecrets across multiple AWS regions, according to Aikido’s analysis. It then attempts to collect the secrets it discovers.
Kubernetes and Vault credentials widen the scope
Kubernetes workloads can expose service-account material through /var/run/secrets/kubernetes.io/serviceaccount/. The malware reads the token, certificate authority certificate, and namespace files from that location.
From there, it uses the service-account token to query the Kubernetes API for secrets in the namespace. KUBECONFIG and ~/.kube/config also sit within its search scope.
Vault credentials receive six collection attempts in priority order, Aikido says. The malware first checks the VAULT_TOKEN environment variable, then ~/.vault-token, followed by a GitHub Actions runner path at /home/runner/.vault-token.
Container paths form another source. The malware can also try Kubernetes authentication with a stolen service-account JWT, or Vault’s AWS IAM authentication route with AWS credentials it has already collected.
Once it obtains a Vault token, the payload enumerates KV mounts through /v1/sys/mounts. It then reads secrets from both KV v1 and KV v2 paths.
The scope extends further. Stripe API keys, Slack tokens, SSH material, Terraform state files, Docker registry credentials, and VPN configuration files all appear in the scanner’s target set.
File scanning targets developer and deployment systems
Aikido says the payload runs roughly 200 filesystem glob patterns, with separate handling for macOS and Linux. It searches .env files and .envrc files, then looks for private-key formats including .pem, .key, .p12, .pfx, and .jks.
SSH keys and configuration files fall into the scan. So do Terraform state files, .tfvars files, and docker/config.json.
The malware skips files larger than 5 MB. It uses up to 64 concurrent reads across the local filesystem.
A generic regular-expression engine scans collected files for secret patterns. Aikido identifies PEM private keys, SSH public keys, Azure storage keys, database connection strings with embedded credentials, and common key=value secret fields among its detection patterns.
IDE configuration receives attention as well. The search includes .vscode/tasks.json and .claude/settings.json, which can contain development tooling settings, command definitions, or environment references.
What to check after the npm attack
Organisations using the affected packages need to identify installations of the compromised versions named by Aikido, including transitive installations within application dependency trees. Lockfiles, build logs, and CI job records can establish whether an affected version entered a build environment.
The relevant check extends beyond the application host. Any system that ran npm install with an infected package could have executed the preinstall script, including developer machines and GitHub Actions runners.
Credentials accessible to those systems require review. The malware targets npm tokens, GitHub tokens, AWS credentials, Kubernetes service-account tokens, Vault tokens, Slack tokens, and Stripe keys.
Package provenance alone cannot serve as the final control in this incident. The attackers used the maintainer’s GitHub account and GitHub Actions release process to publish the malicious versions to npm.
Aikido continues to track the Shai-Hulud package spread and lists setup.mjs and Math_Symbol.js as the files added to the compromised releases.
See also: Amazon ties DPRK hackers to axios and three other npm attacks
Want to learn more about cybersecurity from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the AI & Big Data Expo. Click here for more information.
Developer is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.