Attackers have compromised the GitHub account of the maintainer behind keyv, a popular key-value storage library that pulls in roughly 127 million weekly downloads on npm, and used that access to push credential-stealing malware across the maintainer’s entire package portfolio.
The breach, which unfolded on August 4, 2026, marks one of the largest npm supply chain incidents to date, with the malicious code spreading like a worm to hundreds of unrelated packages within hours. Research on the incident was exclusively shared with Cybersecuritynews by Aikido.
The same maintainer behind keyv also owns several other heavily used caching utilities, including cacheable (29 million downloads a month), flat-cache (565 million downloads a month), file-entry-cache (557 million downloads a month), cache-manager, cacheable-request, and the @cacheable scoped packages. All of them were swept into the same compromise.
Because the attacker pushed malicious files straight to each repository’s main branch and then immediately cut a new release, the poisoned versions were published to npm carrying valid provenance signatures generated by GitHub Actions, making them appear fully legitimate to anyone auditing supply chain integrity.
Keyv npm Package Compromised
Every affected package received two new files, setup.mjs and Math_Symbol.js, along with a “preinstall” hook silently added to package.json that automatically executes setup.mjs during npm install.
Once triggered, setup.mjs functions as a heavily obfuscated dropper that quietly downloads the Bun JavaScript runtime from a GitHub release URL and uses it to launch the true payload, Math_Symbol.js, without any visible prompt to the developer running the install.
This self-propagating design is what has allowed the malware, dubbed part of the Shai-Hulud campaign, to jump beyond the original maintainer’s packages and infect major organizations’ code, including releases tied to Deliveroo, Qlik, Picsart, and others.
As of an update issued at 13:20 CEST on August 4, at least 868 packages spanning 1,381 versions had been confirmed compromised, and the number continues to climb as researchers track ongoing spread across the registry, Aikido said.
Math_Symbol.js is built around a set of targeted credential extractors, each aimed at a specific secret store commonly found on developer machines and CI runners.
It harvests npm registry authentication tokens from .npmrc files, GitHub CLI tokens including classic personal access tokens, session tokens, and OIDC tokens from local GitHub CLI configuration, and AWS access keys and session tokens directly from the ~/.aws/credentials file.
The malware also attempts to capture HashiCorp Vault client tokens by reading the VAULT_TOKEN environment variable, with a fallback mechanism that tries to retrieve a token over HTTP if the environment variable isn’t present.
Because these are the exact credentials used to publish new packages and access cloud infrastructure, a single successful theft can cascade into further account takeovers and additional malicious releases, which appears to be exactly how the worm has continued propagating across the npm ecosystem.
Teams that depend on keyv, cacheable, flat-cache, file-entry-cache, or any related caching packages should immediately audit their lockfiles for the affected versions, rotate npm tokens, GitHub CLI credentials, AWS keys, and Vault tokens on any machine that ran an install during the exposure window, and avoid running fresh installs against affected dependency trees until patched versions are confirmed.
Given the scale and speed of this compromise, security teams should treat any recent CI pipeline run touching these packages as potentially exposed.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
