A sophisticated software supply chain attack has compromised some of the most widely used npm packages in the JavaScript ecosystem, introducing a new malware delivery technique that targets AI coding assistants and developer environments.
Researchers discovered that attackers hijacked the GitHub account of the maintainer behind keyv and the cacheable family of packages, using the trusted identity to publish malicious releases to npm. Unlike traditional package compromises, the campaign introduces persistence mechanisms that can execute when developers simply open a repository in an IDE or launch an AI coding assistant session.
The malware, a heavily evolved descendant of the Shai-Hulud supply chain worm, combines credential theft, self-propagation, AI-agent targeting, blockchain-based command-and-control infrastructure, and a revocation-triggered kill switch.
The incident demonstrates a dangerous evolution in software supply chain attacks: trusted package provenance, signed releases, and dependency verification are no longer sufficient defenses when attackers compromise maintainers directly.
Key Details
The attack began on August 4, 2026, after threat actors compromised the GitHub account belonging to the maintainer of keyv and cacheable-related projects.
Using the stolen account, attackers:
- Pushed malicious code directly to production repositories
- Published trojanized npm packages
- Leveraged legitimate GitHub Actions pipelines
- Distributed signed releases with valid provenance
- Embedded credential-stealing malware
- Added AI-agent persistence mechanisms
Researchers identified 11 malicious releases across 61 packages, although the worm rapidly republished itself into hundreds of additional package variations.
Importantly, the maintainer has been identified as a victim of the compromise rather than a participant.
The software supply chain itself remained technically intact. The attackers simply abused a trusted maintainer identity and legitimate publishing workflows.
Why This Attack Is Different
Most npm compromises follow a familiar pattern:
- Malicious package
- Fake maintainer account
- Suspicious infrastructure
- Obvious malware behavior
This campaign breaks nearly every traditional detection model.
Valid Provenance and Legitimate Releases
The malicious packages were published through legitimate repositories and legitimate release pipelines.
As a result:
✅ GitHub provenance was valid
✅ Attestation signatures were valid
✅ Package integrity checks appeared normal
Traditional supply chain verification controls would therefore not identify the compromised releases as malicious.
The software supply chain accurately verified code originating from a repository that attackers already controlled.
The Semver Trap
One of the most misunderstood aspects of the attack involves package upgrades.
Many reports focused on keyv@6.0.0, but that package required explicit installation because it represented a major version bump.
The real danger originated elsewhere.
Several cacheable packages received malicious patch releases that remained within existing version constraints.
Examples included:
- cacheable-request 13.0.20
- cache-manager 7.2.10
- @cacheable/utils 2.5.1
Because these releases stayed inside declared dependency ranges, organizations could unknowingly install malicious versions during routine dependency resolution without changing package manifests.
This created a significantly broader infection path than explicit installation of keyv itself.
AI Agents Become an Infection Vector
The most innovative feature of the campaign is its use of AI coding assistants as both targets and execution mechanisms.
Traditionally, malware executes when developers:
- Run installers
- Execute binaries
- Perform package installations
This worm introduced a different model.
Researchers observed malicious persistence mechanisms added to:
Plain Text
1
.claude/settings.jsonShow more lines
and
Plain Text
1
.vscode/tasks.jsonShow more lines
These files were deliberately cross-connected so that each triggered execution of malware located in the other.
As a result, infection could occur when:
- Opening a repository in VS Code
- Starting a Claude Code session
- Loading a workspace
In several scenarios:
No npm install was required.
This represents a significant shift in supply chain security because the compromise can occur through development workflow interactions rather than software installation events.
Advanced Evasion Techniques
The malware employs multiple sophisticated techniques rarely seen together in open-source attacks.
Bun Runtime Execution
The payload uses an obfuscated installer that downloads:
Plain Text
1
BunShow more lines
and executes malware through the Bun runtime rather than the host Node.js environment.
This offers several advantages:
- Bypasses Node-specific monitoring
- Reduces compatibility issues
- Uses trusted infrastructure
- Avoids suspicious download domains
Because Bun binaries are downloaded from legitimate GitHub releases, network security tools may not identify the activity as malicious.
Ethereum-Based Command and Control
Rather than hardcoding infrastructure, attackers concealed command-and-control locations inside an Ethereum smart contract.
The malware queries the blockchain to retrieve updated infrastructure dynamically.
Benefits include:
- Infrastructure resilience
- Dynamic reconfiguration
- Reduced IOC effectiveness
- Avoidance of static domain blocklists
Traditional security controls built around domain reputation become significantly less effective when infrastructure is resolved through blockchain queries.
Encrypted Data Theft
The malware encrypts stolen information using:
- AES-256-GCM
- RSA public-key wrapping
- Host-specific fingerprints
Each infected system receives a unique identifier, enabling operators to track individual victims and potentially deliver targeted payloads.
Researchers noted that successful command-and-control responses can return executable code that is passed directly into an evaluation function, effectively granting remote code execution capabilities.
What Information Is Being Stolen?
The malware dramatically expands the scope of credential theft compared to previous supply chain campaigns.
Targeted assets include:
Cloud Credentials
- AWS credentials
- Azure authentication data
- GCP configurations
- Alibaba Cloud accounts
- Tencent Cloud environments
CI/CD Systems
- GitHub Actions tokens
- Repository secrets
- npm credentials
- Jenkins secrets
- Argo CD credentials
- Harbor registry access
AI Platforms
The malware specifically targets:
- Claude
- OpenAI
- Codex
- Cursor
- Gemini
This is one of the first major supply chain attacks to explicitly harvest AI-agent credentials and configuration stores.
Infrastructure Secrets
Researchers observed collection of:
- Kubernetes tokens
- Vault tokens
- SSH credentials
- Terraform configurations
Cryptocurrency Assets
The malware also gathers:
- Wallet information
- Solana keys
- Monero artifacts
- Foundry configurations
Operating System Data
Sensitive system files may also be targeted, including password-related resources and local credential stores.
The Kill Switch Changes Incident Response
One of the most dangerous aspects of the campaign is its response to credential revocation.
Researchers identified watcher components that continuously validate stolen GitHub tokens.
When access failures occur, the malware treats the event as an indicator of discovery and triggers additional cleanup or follow-on actions.
This creates a significant response challenge.
Many organizations immediately revoke credentials after discovering compromise.
In this case, security teams are advised to:
- Identify persistence
- Remove watcher mechanisms
- Contain malicious processes
- Eliminate execution paths
- Then rotate credentials
The order becomes critical to prevent triggering additional malicious behavior.
Impact and Risks
Organizations using affected npm packages face risks well beyond package compromise.
Potential impacts include:
Developer Workstation Compromise
Simply opening repositories or launching AI development tools may execute malicious code.
Software Supply Chain Contamination
Compromised build systems may unintentionally republish infected packages.
Credential Theft
Cloud, CI/CD, AI, registry, and infrastructure credentials may be exposed.
Lateral Movement
Stolen access can enable further compromise of development environments and production systems.
Persistent Access
Cross-wired IDE and AI-agent persistence mechanisms allow malware to survive partial remediation attempts.
Remote Code Execution
Operators can potentially execute arbitrary code through command-and-control responses.
Expert Recommendations
Organizations should immediately review npm environments for vulnerable package versions and investigate systems that interacted with affected releases.
Audit Installed Dependencies
Validate actual installed packages rather than relying solely on package manifests.
Roll Back Vulnerable Versions
Rollback to verified safe releases instead of upgrading blindly to current versions.
Treat Systems as Compromised
Developer workstations, build systems, and CI/CD runners that executed affected packages should be considered compromised.
Remove AI-Agent Persistence
Both IDE and Claude Code persistence mechanisms must be removed.
Eliminating only one can leave the other operational.
Investigate Credential Exposure
Organizations should assess the potential compromise of:
- Cloud credentials
- Source-control accounts
- Registry access
- Kubernetes environments
- AI platform credentials
Strengthen Supply Chain Controls
Security teams should implement:
- Dependency allowlisting
- Package age controls
- Runtime monitoring
- CI/CD behavioral detection
- Continuous dependency auditing
Industry Context
The campaign represents a new phase in software supply chain attacks.
Historically, attackers focused on:
- Dependency confusion
- Malicious packages
- Typosquatting
- Build system compromises
This incident expands the threat model by targeting:
- AI coding assistants
- Repository-opening workflows
- Developer tooling
- Blockchain-based infrastructure
Perhaps most importantly, it shows that package provenance alone is insufficient when attackers compromise trusted maintainers directly.
The security community increasingly recognizes that trust in software supply chains must extend beyond signatures and attestations to include behavioral detection and runtime monitoring.
Conclusion
The latest Shai-Hulud variant demonstrates how software supply chain attacks continue evolving far beyond traditional package poisoning.
By combining maintainer account compromise, valid software provenance, AI-agent persistence, Ethereum-based command-and-control infrastructure, and sophisticated credential theft mechanisms, attackers created a campaign capable of infecting developer systems without requiring package installation.
The attack serves as a stark reminder that trust is now the primary target of software supply chain adversaries. Signed releases, trusted repositories, and legitimate publishing workflows remain valuable defenses, but attackers increasingly exploit the humans behind those systems rather than the systems themselves.
For organizations, defending against the next generation of supply chain attacks will require visibility into developer environments, AI assistants, runtime behavior, and software provenance working together.
FAQ SECTION
What is the Shai-Hulud npm worm?
It is a supply chain malware campaign that compromised trusted npm packages and used them to steal credentials, establish persistence, and spread to additional environments.
Was the keyv maintainer involved?
No. Researchers identified the maintainer as a victim of the account compromise, not a participant in the attack.
Can systems be infected without running npm install?
Yes. Researchers found persistence mechanisms tied to VS Code and Claude Code configurations that could execute simply by opening a repository or starting an AI coding session.
Why didn’t provenance verification stop the attack?
The attacker used a legitimate maintainer account and legitimate release pipelines, causing malicious releases to carry valid provenance and attestations.
What credentials were targeted?
The malware targeted cloud accounts, GitHub tokens, npm credentials, Kubernetes secrets, CI/CD infrastructure, AI platform credentials, and cryptocurrency wallets.
