Shai-Hulud Supply Chain Attack Compromises Keyv and Hundreds of npm Packages

Attackers have compromised the GitHub account of a Keyv maintainer, a widely used JavaScript key-value storage library, to distribute credential-stealing malware via npm packages.

This ongoing supply chain attack, known as the Shai-Hulud campaign, has affected Keyv and several related caching libraries, with a combined monthly installation reach in the billions.

Aikido Security reported that the compromise occurred on August 4, 2023, after threat actors gained access to the maintainer’s GitHub account.

The attackers pushed malicious files directly to the main branches of the affected repositories. They quickly published new versions of the npm packages using GitHub Actions.

Shai-Hulud Supply Chain Attack Compromises Keyv

Since these releases were generated through legitimate project workflows, the compromised packages carried valid GitHub Actions provenance, potentially misleading automated dependency management and software supply chain verification processes into believing the releases were trustworthy.

Affected packages include Keyv, cacheable, cache-manager, cacheable-request, flat-cache, file-entry-cache, and several @cacheable packages. These libraries are widely used in Node.js development environments for caching, storage, and dependency management functions.

At the time of Aikido’s update, the self-propagating malware campaign had reportedly compromised at least 8,686,868 npm packages across 1,381 package versions. The affected packages together recorded over 222 billion monthly installations, illustrating the potential scale of downstream exposure.

Malicious Preinstall Payload

The malicious package versions contain two newly added files: `setup.mjs` and `Math_Symbol.js`. Additionally, attackers modified each affected `package.json` file to include the following preinstall hook:

"preinstall": "node setup.mjs"

This causes the payload to run automatically before the npm installation process completes. The `setup.mjs` file acts as an obfuscated dropper, downloading the Bun JavaScript runtime from a GitHub-hosted release and executing `Math_Symbol.js`, the main malware payload.

`Math_Symbol.js` is a heavily obfuscated JavaScript file of approximately 728 KB. It contains modules designed to collect credentials, encrypt the stolen data, and exfiltrate it to a public GitHub repository associated with the campaign, which reportedly carries the description “Shai-Hulud: Here We Go Again.”

The payload targets valuable developer and cloud credentials, including npm authentication tokens stored in `.npmrc`, GitHub CLI personal access tokens, session tokens, and OpenID Connect tokens. It also searches for AWS access keys and session credentials in `~/.aws/credentials`.

Furthermore, the malware attempts to steal HashiCorp Vault tokens from the `VAULT_TOKEN` environment variable and may try to retrieve tokens using HTTP-based fallback logic.

The Shai-Hulud payload includes worm-like propagation capabilities designed to compromise packages belonging to other maintainers whose environments have installed an infected dependency. Reports indicate that packages from organizations such as Deliveroo, Picsart, Qlik, and others have already been affected.

Organizations should immediately check whether affected versions exist in repositories, lockfiles, CI/CD runners, developer workstations, and build artifacts.

Teams should remove the malicious versions, rotate npm, GitHub, AWS, Vault, and other credentials accessible from potentially compromised environments, and review package publishing activity for any unauthorized releases.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.