I ran npm install on a project this morning without thinking twice about it, the same way I have a thousand times before.
That’s exactly the reflex attackers are counting on right now. A live supply chain attack has already poisoned hundreds of npm packages tied to more than two billion monthly installs, and it started with something as mundane as one developer’s GitHub login falling into the wrong hands.
A Trusted Maintainer’s Account Becomes Ground Zero
The attack traces back to the compromised GitHub account of the maintainer behind keyv, a key-value storage library that pulls in roughly 127 million weekly downloads on npm. Whoever gained access didn’t stop at keyv, the same maintainer’s portfolio includes several other heavily used caching utilities, among them cacheable, flat-cache, file-entry-cache, cache-manager and cacheable-request, some individually racking up hundreds of millions of monthly downloads on their own, according to Aikido Security, the firm that first flagged the compromise.
I find that part genuinely unsettling. This wasn’t a random unknown package with a handful of downloads. It was infrastructure so ordinary that most developers never stop to question it, which is precisely why it made such an effective entry point.
Inside The Worm’s Credential-Stealing Playbook
Once installed, the malicious code fires through a preinstall script, meaning it can execute before a developer even realizes the install finished. From there it goes hunting: npm authentication tokens sitting in local .npmrc files, GitHub CLI tokens including personal access tokens and OIDC tokens, AWS access keys pulled from ~/.aws/credentials, and secrets from Kubernetes and HashiCorp Vault setups, per reporting from OX Security. Security researchers have tied the payload to the same “Shai-Hulud” malware family that first surfaced in 2025 and has resurfaced in several variants since, as Palo Alto Networks’ Unit 42 has documented.
What makes it a worm rather than a simple theft is what happens next. Once it steals a developer’s or maintainer’s credentials, it uses them to publish poisoned versions of that person’s own packages, letting the infection jump from one codebase to the next without any human attacker needing to lift a finger.
How Far The Infection Has Spread
The numbers have been moving fast, and honestly, that’s part of what makes this so hard to pin down cleanly. Aikido’s tracking put the count at a minimum of 868 compromised packages across 1,381 versions, representing over two billion monthly installs, in an update issued hours after the initial break. Separately, supply chain security firm SafeDep built its own registry-backed tally and landed on 1,684 poisoned versions spanning 420 package names, tied to at least nine organizations. The gap between those two figures isn’t really a contradiction, it’s a sign this is still an active, unfolding incident rather than a finished inventory anyone can point to with certainty.
The initial alert that pushed this into wider view came from a security researcher tracking the spread in real time, flagging the scale of the compromise as new packages kept turning up infected roughly every few minutes.
The Trust Signal That Made It Worse
Here’s the detail that stuck with me most. The attacker didn’t just push malicious code manually, they cut new releases through GitHub Actions, the same automated workflow legitimate maintainers use. That gave the poisoned npm versions valid GitHub Actions provenance, the exact badge many automated tools rely on to decide whether a package release is trustworthy. In other words, the attack didn’t just slip past security checks; it used the ecosystem’s own verification signals against it.
Stolen credential bundles are then pushed to public GitHub repositories carrying the description “Shai-Hulud: Here We Go Again,” created directly under the compromised developers’ own accounts. SafeDep counted 546 such repositories created on the day of the attack alone, each holding a results folder where harvested data lands, meaning the theft was, in a strange way, happening in plain sight for anyone who knew what to search for.
Who Else Has Been Hit
Because the worm spreads through whatever packages an infected developer happens to maintain, the damage hasn’t stayed contained to the caching-library world. SafeDep’s tracking identified affected code tied to at least nine separate organizations, including names as recognizable as Deliveroo and Qlik, within roughly half an hour of the initial spread. That speed is the part worth sitting with, this wasn’t a slow leak discovered weeks later, it was a cascade that reached unrelated companies’ codebases in the time it takes to eat lunch.
As of the most recent reporting, neither the keyv maintainer, npm, nor GitHub had issued a public statement addressing the incident, leaving affected developers largely reliant on independent security researchers for guidance in the meantime.
What Comes Next For Millions Of Developers
If there’s a silver lining, it’s that this campaign fits a pattern security teams have now seen several times since 2025, which means the remediation playbook is fairly well established: rotate every npm, GitHub, AWS and Vault credential that touched a machine which installed an affected package, audit lockfiles against the growing list of confirmed-compromised versions, and disable install scripts you don’t strictly need running. None of that undoes the exposure that’s already happened, but it closes the door before a stolen token gets used for the next wave.
What strikes me most, writing this out, is how little any individual developer did wrong. Nobody clicked a phishing link to trigger this. They just ran the same install command they run every day, on a package almost everyone trusted implicitly. That’s the real story here, not a single mistake, but a supply chain built on layers of trust that, once broken at the top, cascade far faster than anyone can patch by hand.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. Follow us on X @nulltxnews
Be the first to comment