keyv, cacheable and other npm caching packages hijacked: install-time credential theft that spread itself to hundreds of packages (Shai-Hulud / ChainDrop)

Who is affected

This is not a coding bug. The packages themselves were replaced with malicious versions. So there is no CVE, no NVD CVSS score, and no CISA KEV entry (Snyk’s own vulnerability database does score keyv 6.0.0 at CVSS 4.0 9.3). The official identifiers are OSV MAL- IDs and GitHub security advisories (GHSA), with weakness type CWE-506 (Embedded Malicious Code). GitHub’s “patched versions” field says “None”: the fix is not a patch, it is to stop using those versions.

The 11 directly compromised releases (Snyk, Aikido and Datadog agree):

The npm registry’s publish times also show ecto 5.0.0 (2026-06-25) as the release before 5.0.1. Endor Labs gives a general rule: pin to versions published before 2026-08-04 09:30 UTC.

@keyv/ adapter packages: sources disagree.* OSV and GHSA also list version 6.0.0 of 19 @keyv/* packages as malicious (for example @keyv/redis is MAL-2026-12020 and @keyv/compress-gzip is MAL-2026-12010): @keyv/bigmap, @keyv/cloudflare-kv, @keyv/compress-brotli, @keyv/compress-gzip, @keyv/compress-lz4, @keyv/dynamo, @keyv/encrypt-node, @keyv/encrypt-web, @keyv/etcd, @keyv/memcache, @keyv/mongo, @keyv/mysql, @keyv/postgres, @keyv/redis, @keyv/serialize-msgpackr, @keyv/serialize-superjson, @keyv/sqlite, @keyv/test-suite, @keyv/valkey. The npm registry shows these 6.0.0 releases were published on 2026-08-04 between 09:30 and 09:32 UTC, a few minutes before keyv@6.0.0. Socket includes them in its timeline but says these versions do not contain the preinstall hook; it treats them as suspect because of the account compromise and confirms the payload only in the packages in the table above. The Amazon Inspector analysis attached to the OSV records (for example @keyv/redis) likewise reports no install-time execution or credential theft. Chainguard says the @keyv/* adapter packages were never affected. This page cannot tell which side is right; our suggestion is to be conservative and not use the 6.0.0 release of these packages.

These packages are downloaded enormously. Per Aikido, keyv sees about 604 million downloads a month, flat-cache about 580 million, file-entry-cache about 571 million, cacheable-request about 137 million and cacheable about 30 million.

Second wave: the worm. The malware used stolen npm tokens to infect other packages. Counts differ because each researcher took a snapshot at a different time:

Named downstream scopes include @ornikar/*, @onereach/*, @or-sdk/*, @servicetitan/*, @qlik/*, @picsart/* and @deliveroo/*. Overall: more than 400 packages and well over 1,000 versions.

Who was likely to pick it up (our inference, not stated by any source): the bad keyv release is a new major version, 6.0.0, so projects allowing only ^5.x would not get it automatically. But the bad flat-cache, file-entry-cache, cacheable-request and cache-manager releases are patch bumps, so projects using ^ or ~ ranges that re-resolved dependencies while the bad versions were available could have received them automatically. The bad versions were published on 2026-08-04, but infected downstream packages kept being published until 13:18 that day (SafeDep), and private registries, mirrors or caches can keep versions npm has removed, so later installs could still pick them up; that is why Snyk advises purging them from private registries and caches.

This assumes install scripts ran. The malware starts from a preinstall script, and OSV says to treat any environment that installed the version “with install scripts enabled” as fully compromised. Installing with --ignore-scripts, or with npm v12 (generally available since 2026-07-08, which does not run dependency preinstall, install or postinstall scripts unless explicitly allowed), does not trigger it. We have not checked the defaults of other package managers. The IDE config-file path below does not need an install at all.

Also, you can be hit without running npm install: opening a repository with planted .claude/ or .vscode/ config files can trigger execution, but sources describe the condition differently. OSV says the loader runs when a developer or AI coding agent opens a clone. Snyk says this execution path appears when a developer or coding agent trusts and activates project-local configuration, and that VS Code may ask first, depending on workspace trust and user settings.

How it works

1. Way in: the maintainer’s account. The attacker controlled the maintainer’s GitHub account. How is unknown. The attacker pushed malicious files straight to main, then reset and replayed the git history to hide what happened.

2. The project’s own pipeline signed off on it. OSV says the attackers pushed the payload to the source repository and cut releases through GitHub Actions, so the poisoned versions reached npm with a valid, signed provenance attestation. Snyk says npm’s metadata names GitHub Actions as the trusted publisher for keyv@6.0.0. Snyk’s key point: provenance proves where and how a package was built, not that its source is trustworthy.

3. Runs at install time. The attacker added a preinstall script to package.json, so the loader setup.mjs runs during npm install, before any application code. It downloads a standalone Bun runtime (1.3.13) and then runs a roughly 728 KB obfuscated second stage, Math_Symbol.js (also called math_init.js). Socket and Datadog think Bun was chosen to slip past monitoring that only watches Node.js.

4. What it steals. Cloud credentials (AWS, GCP, Azure, including instance metadata), GitHub and npm tokens, Kubernetes service-account tokens, HashiCorp Vault, SSH keys, database connection strings (SafeDep says it looks for MongoDB, MySQL, PostgreSQL and Redis URLs with inline credentials), Terraform state, Docker configs, and Stripe and Slack tokens. Wiz adds crypto wallets and AI tool credentials and configs (Claude, OpenAI, Cursor, Gemini). Datadog says that on Linux with sudo available it reads the memory of GitHub Actions runners. Workflows named “Run Copilot” dump every repository secret at once.

5. Where it goes. Data is encrypted and sent to attacker servers, whose list is looked up from an Ethereum smart contract. The fallback is creating public GitHub repositories described as “Shai-Hulud: Here We Go Again” (SafeDep counted more than 1,000). Datadog notes the server’s reply is executed as code, which amounts to a general-purpose backdoor.

6. How it spreads. Two routes: it uses stolen npm tokens to inject the loader into every package they can publish and republishes them (SafeDep saw some organizations publishing about one package per second), and it commits .claude/settings.json (a Claude Code SessionStart hook) and .vscode/tasks.json (runOn: folderOpen) into repositories it can write to.

7. Dead-man’s switch. It installs gh-token-monitor (a macOS LaunchAgent or Linux systemd user service), which checks GitHub every 60 seconds and runs an attacker-supplied handler if the token is revoked (SafeDep, Snyk). Wiz says the switch in this version is armed selectively based on the attacker server’s response: the server can reply with a command that arms it and names the token to watch.

Risky install pattern (conceptual illustration, not malicious code):

# In CI: resolve loose version ranges on the fly and let every dependency's install scripts run
npm install

Safer install pattern (conceptual illustration):

# Install exact versions from the lockfile and run no dependency lifecycle scripts
npm ci --ignore-scripts

{
  "overrides": {
    "keyv": "5.6.0",
    "flat-cache": "6.1.23",
    "file-entry-cache": "11.1.5",
    "cacheable-request": "13.0.19",
    "cache-manager": "7.2.9"
  }
}

(Adjust override versions to the major versions your dependency tree actually uses.)

Timeline

There is no CVE publication date and no CISA KEV addition.

Further reading

• Scoring: there is no CVE, so no NVD score. GitHub rates the keyv advisory Critical (malware), and Snyk’s vulnerability database scores keyv 6.0.0 at CVSS 4.0 9.3 (Critical).
• Version notes: when Chainguard wrote, it marked the versions of file-entry-cache, cacheable, @cacheable/memory and @cacheable/node-cache as uncertain.
• Not established: how the maintainer account was compromised; the current state of these versions on npm (we could not check); any statement from the maintainer (none found; the only related issue on the keyv repository, #2051, was opened by a third party and is closed).
• Campaign: Datadog and CSA call this malware “ChainDrop”, from the Shai-Hulud family. Wiz calls it a descendant of “Mini Shai-Hulud”, built on public repositories from TeamPCP, but does not say TeamPCP carried out this attack. SafeDep says a direct link to earlier incidents is unconfirmed; the “Here We Go Again” marker only suggests continuity or shared infrastructure.
• Background: the original Shai-Hulud was found on 2025-09-14; GitHub removed more than 500 packages and announced npm hardening. The 2026-05-11 Mini Shai-Hulud / TanStack incident was attributed by Wiz with high confidence to TeamPCP, and got in through a chain of GitHub Actions weaknesses, unlike this account takeover. Chainguard counts keyv as the third 2026 wave using the same toolkit (April: PyTorch Lightning; May: @antv) but does not list TanStack, so the wave numbering depends on the source. For the April and @antv waves this page has only Chainguard as a source.
• Related weakness type: CWE-506.