A credential-stealing worm infiltrated the npm registry and infected hundreds of software packages on August 4, 2026, according to a report published by The Hacker News. The malicious code first appeared in keyv@6.0.0 before spreading across multiple organizations through stolen developer access tokens. SafeDep confirmed 353 compromised versions across 79 package names, while Aikido later counted at least 868 packages across 1,381 versions, though no complete public list could be independently verified at the reporting cutoff.
The attack used a preinstall script to execute a credential-harvesting bundle inside developer workstations and continuous integration environments. SafeDep's analysis shows the 727,680-byte compiled payload collects GitHub, npm, cloud provider, Vault, Kubernetes, database, and private-key credentials. It also reads GitHub Actions runner memory, installs a token-revocation watcher, and carries npm publishing machinery that allows it to poison additional packages using stolen credentials. The Keyv repository contained separate Claude Code and Visual Studio Code hooks that can trigger the payload once a user trusts the workspace or permits the project configuration. SafeDep later expanded its registry count to 1,684 poisoned versions across 420 package names tied to nine organizations, and the firm said the worm jumped between organizations every two to seven minutes, completing its cross-organization publishing burst in roughly half an hour.
The malicious keyv@6.0.0 release added "node setup.mjs" as a preinstall command and included setup.mjs and Math_Symbol.js files while leaving the compiled library code untouched, according to the report. Stage one checks for Bun, downloads version 1.3.13 from the runtime's official GitHub releases if needed, and passes control to the compiled bundle. Socket separately decoded code for modifying, versioning, and republishing packages available to a stolen npm identity. At 5:40 p.m. India Standard Time on August 4, npm package pages showed earlier releases restored as latest for at least nine packages from SafeDep's initial set, including keyv@5.6.0, flat-cache@6.1.23, and cache-manager@7.2.9. The poisoned Keyv release carried valid OpenID Connect and Supply-chain Levels for Software Artifacts provenance because it passed through the project's legitimate GitHub Actions release workflow, though the attestation couldn't establish that the source entering the build was safe. SafeDep also counted 546 public GitHub repositories created on August 4 with the description "Shai-Hulud: Here We Go Again" and a results/ directory, representing potential exfiltration or staging artifacts rather than confirmed victims.
Socket says any workstation or runner that executed an affected version should be treated as credential-exposed. SafeDep advises responders to remove the malware's credential-revocation watcher before rotating exposed tokens and keys, because revocation triggers the watcher and rotating first can run an attacker-supplied local handler. The researchers said automated propagation best fits the timing and whole-namespace publishing bursts, although the initiating function wasn't recovered. The evidence doesn't show whether the worm spread solely from one stolen publishing identity or also involved separately compromised publisher credentials. Semgrep documented the same Claude Code and VS Code hooks, setup.mjs filename, and Bun 1.3.13 download in an April compromise of the lightning PyPI package, and Aikido places the August activity in the Shai-Hulud family, supporting a malware-family connection though no named actor is known.
SafeDep said the poisoned Keyv and Cacheable releases have since been unpublished, but latest still resolved to a malicious version for most other affected package names at the time of its update, meaning upgrading alone may preserve the exposure. Teams should compare lockfiles and resolved versions against the affected-package list, disable unnecessary install scripts, and treat environments that executed an affected release as compromised. npm 12 blocks unapproved dependency lifecycle scripts by default, but earlier npm clients and other install paths that permit lifecycle scripts remain exposed. The repository's .claude and .vscode directories remained on main in a fresh check, still containing the files associated with the separate execution path. The supply-chain attestations that developers rely on to verify software integrity proved insufficient when the compromise originated inside the legitimate build pipeline itself. Organizations that treat provenance badges as a security guarantee may now reconsider whether signature verification alone can protect against threats that hijack the upstream credential layer.