TL;DR

A new wave of the Shai-Hulud npm worm has compromised the keyv / cacheable family of packages - dependencies that together pull well over 2 billion downloads per month.

• Credential Harvesting: The malicious versions harvest developer and CI credentials, cloud secrets, and crypto wallets.

• Worm Propagation: They then use any stolen npm token to publish themselves into more packages.

What Actually Happened?

The Shai-Hulud campaign represents a massive supply-chain attack where threat actors hijacked developer accounts managing foundational open-source npm packages downloaded over 2 billion times a month. By quietly injecting malicious code into these trusted libraries, any developer or automated pipeline updating their dependencies unwittingly pulled in the infection.

To ensure operational longevity and resilience against security takedowns, the creators concealed their command-and-control server resolution inside blockchain smart contracts. This Web3-backed mechanism allowed the malware to dynamically resolve its active C2 servers without relying on static domains that defenders could easily block or sinkhole.

What made this outbreak particularly destructive was its automated "worm" behavior. The moment an infected package landed on a system, the malware scanned for local publishing tokens and immediately hijacked the victim's own software projects—automatically publishing compromised updates to their code and triggering an exponential, self-propagating chain reaction across the entire software ecosystem.

Attack Kill Chain

Malware Architecture & Dynamic Execution Findings

Smart Contract-Based Payload Delivery (C2 Resolution)

The malware leverages a decentralized smart contract as a dead-drop resolver for its C2 infrastructure. Instead of relying on static IPs or domains, the loader queries a blockchain contract to resolve the active C2 server (e.g., npm-cache.com). From there, it fetches the primary ~100 MB binary payload directly to disk. This Web3 delivery mechanism grants full operational resilience, allowing attackers to rotate payload infrastructure without modifying the npm package.

Post-Exploitation & Credential Harvesting

Runtime analysis reveals that once executed, the binary performs deep file access and memory extraction targeting high-value assets across the system:

Key Takeaways & Immediate Remediation Plan

Assume any environment that executed affected versions of keyv, flat-cache, or related packages is fully compromised. Prioritize immediate credential revocation over simple package updating.

Audit Lockfiles & Pin Safe Versions

Inspect package-lock.json, yarn.lock, and pnpm-lock.yaml across all projects. Immediately downgrade or purge affected dependencies and enforce strict version pinning. Use npm install --ignore-scripts in untrusted pipeline runs.

Rotate All Exposed Tokens & Cloud Credentials

Immediately revoke and regenerate all npm auth tokens, GitHub PATs/OAuth tokens, AWS access keys, GCP service accounts, and Slack/Stripe API keys accessible from affected developer machines or CI/CD runners.

Secure CI/CD Pipelines & OIDC Integrations

Flush GitHub Actions secrets and invalidate active runner OIDC session tokens. Ensure build environments do not share persistent disk space or privileged IAM roles across unvetted pull requests.

Endpoint Hunt & Crypto Asset Protection

Search developer endpoints for unexpected Bun binary downloads, Math_Symbol.js executions, or outbound HTTPS traffic to C2 resolvers like npm-cache.com. Immediately transfer assets from any local crypto wallets (e.g., Ledger Live, Exodus, Electrum) present on impacted hosts.