The Shai-Hulud npm worm bypassed security checks with legitimate signatures
Malware infiltrating Keyv library impacted over 2 billion monthly downloads
1The attack's inception
On June 25, 2026, an attacker compromised the GitHub account of the developer maintaining keyv, a storage library downloaded 127 million times weekly. Within hours, poisoned versions of keyv and related caching packages were live on npm, carrying a credential-stealing worm. Security firm Aikido identified at least 868 compromised packages across 1,381 versions, collectively exceeding 2 billion monthly installs, with numbers still rising.
2Exploitation of trusted signatures
The most concerning aspect was that poisoned packages shipped with valid provenance signatures - cryptographic proof the industry developed to verify package origins. The worm didn't forge these signatures; it legitimately earned them by using the maintainer's GitHub Actions workflow. This allowed npm to generate authentic attestations, making poisoned builds appear trustworthy to supply chain auditors.
3CrowdStrike's warning
One day before the attack, CrowdStrike published its 2026 Threat Hunting Report predicting exactly this attack vector. The report highlighted evolving software supply chain attacks targeting package registries, with npm packages at the center - accounting for 87% of malicious registry threats CrowdStrike tracked in H1 2026. The keyv worm turned these findings into reality within 24 hours, demonstrating the immediate threat.
4Poisoned package propagation
The attacker pushed malicious files directly to main branches of repositories the maintainer controlled, then immediately cut new releases. When a poisoned package reached a developer's environment or build runner, its payload harvested all accessible credentials. Using found npm publishing tokens, it backdoored other victim-controlled packages. Aikido observed dozens of newly infected packages appearing every few minutes, creating an unwitting distribution network.
5Corporate impact
The attack's blast radius extended far beyond obscure utilities. As keyv is a transitive dependency for many popular tools, the worm propagated into corporate npm scopes. Confirmed affected releases included those tied to Deliveroo, Qlik, and Picsart. Developers at these companies never intentionally installed keyv - they simply depended on tools that depended on it through dependency trees nobody manually reviews.
6Attackers' true target
Credential extractors in the payload revealed the attackers' actual objectives weren't caching libraries. JFrog and Wiz found the malware harvesting cloud access keys, CI secrets, and production infrastructure authentication tokens. The package compromise served as a vehicle, with the cloud environment being the ultimate destination. CrowdStrike noted 171% growth in cloud-conscious criminal activity in H1 2026, with supply chain attacks being a primary vector.
7Infiltration of developer tools
The worm didn't stop at credential theft - it established persistence in developers' work environments. Wiz discovered the malware dropping payloads in two directories: one for Visual Studio Code and another (.claude) for Anthropic's Claude Code agent. Setup files enabled execution when developers opened infected projects in their editors or initiated AI coding sessions - not just during installation. This precisely targeted the developer ecosystem CrowdStrike warned about.
8Simple preventive measure
One zero-cost control could have mitigated the worm's impact. CrowdStrike's Adam Meyers explained: securing the software supply chain through simple measures like preventing tools from automatically pulling the very latest dependencies. A slight delay - perhaps using last week's dependencies - maintains near-current status while avoiding the risk of immediately incorporating malicious updates pushed minutes earlier.
9npm and pnpm solutions
This guidance isn't theoretical. npm implemented this capability in February 2026 (CLI v11.10.0) as the min-release-age setting, following pnpm's minimumReleaseAge feature from five months prior. Both allow teams to mandate minimum package ages (e.g., one week), giving the security community time to identify poisonings that would otherwise spread to all downstream builds within minutes.
10Industry-wide implications
The incident underscores software supply chain fragility, showing how a single account compromise can trigger registry-wide impacts. The clear message for security teams: trust signals can be satisfied by attackers controlling the right accounts, and the disclosure-to-exploitation window has shrunk beyond what monthly patching cycles can address. This demands fundamental changes in cloud security and development processes.
11Future risks
As CrowdStrike's report warned, the entire developer ecosystem - including package registries, CI pipelines, container registries, and editor extensions - is now direct attack surface. npm packages sit at the center of this shift. The keyv worm demonstrated how rapidly such attacks can propagate and their potential scale. For security architects, this necessitates reevaluating current defense strategies.
12Conclusions and recommendations
The Shai-Hulud campaign proves software supply chain security requires urgent reconsideration. Even simple measures like dependency delay mechanisms can significantly impact risk. Organizations must review dependency management policies, implement controls like minimum release ages, and harden developer tools. The shrinking disclosure-to-exploitation window renders traditional patch management inadequate. Proactive threat hunting and real-time monitoring have transitioned from luxury to necessity in modern software development.