Major Shai Hulud campaign strikes npm again, affecting keyv and 400+ packages

The JFrog security research team identified a new version of the Shai-Hulud supply-chain malware affecting over 428 packages across 1700+ versions. The compromise started with the keyv and cacheable npm packages. Both are widely used caching libraries, and keyv is a transitive dependency of many popular tools. If you installed a compromised version, assume your environment is affected. This is an ongoing investigation. We will update this post as we confirm more affected packages and victim scope.

Important note: on npm 12 or newer, preinstall lifecycle hooks do not run by default, so the malware does not execute during install.

Technical analysis

We analyzed a 710 KB JavaScript payload from the infected keyv@6.0.0 package. It is a newer variant of Shai-Hulud, and is obfuscated differently compared to previous versions of the campaign. They proudly identify it as Shai-Hulud via the GitHub repository description Shai-Hulud: Here We Go Again. It has four connected objectives:

1. Collect local, CI, cloud, Kubernetes, and Vault secrets.
2. Exfiltrate encrypted results through a dynamic HTTPS endpoint or attacker-created public GitHub repositories.
3. Use stolen npm credentials to publish infected patch releases of every writable package.
4. Use GitHub credentials and GitHub Actions to infect repositories and steal more credentials.

The analyzed sample's SHA-256 is 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc.

npm infection path

An infected package runs node setup.mjs during preinstall. The loader is a small Node.js bootstrap that works on Linux, macOS, and Windows. It uses an installed bun executable when available. Otherwise it downloads Bun 1.3.13 from the official release on GitHub, extracts it, and runs the real payload, math_init.js. They remove the temporary Bun copy right afterwards.

The worming logic is what makes this campaign dangerous, similarly to previous Shai-Hulud-style campaigns. When the collector finds an npm token, it validates the token before exfiltration even completes. The token must map to an npm token object with bypass_2fa === true and package write permission. For every package writable with that token, the worm:

1. Downloads the current latest tarball.
2. Copies the running sample to package/math_init.js.
3. Writes the loader to package/setup.mjs.
4. Replaces the package's complete scripts object and sets scripts.preinstall to node setup.mjs.
5. Increments the patch version.
6. Repackages and publishes with a direct authenticated PUT to the npm registry.

Repository execution hooks

The worm also commits five files to GitHub branches it can reach:

.vscode/tasks.json
.vscode/setup.mjs
.claude/math_init.js
.claude/settings.json
.claude/setup.mjs

The configuration is mutually reinforcing. .vscode/tasks.json defines an Environment Setup task that runs node .claude/setup.mjs when a folder opens. .claude/settings.json defines a SessionStart hook that runs node .vscode/setup.mjs. Both setup files contain the Bun bootstrap, and .claude/math_init.js is the worm. Opening an infected repository in VS Code, or starting a Claude session in it, is enough to execute the payload.

Commits are pushed through GitHub's GraphQL createCommitOnBranch mutation to up to 50 branches per repository, skipping dependabot/* and copilot/*. The commit message is chore: update config with a forged Co-authored-by: claude <claude@users.noreply.github.com> trailer (even though it was not committed by Claude). Protected branches fail at commit time, but one writable branch is enough.

GitHub Actions secret harvesting

For a stolen ghp_ or gho_ token with workflow scope, the worm runs a more targeted operation:

1. Enumerates up to 100 repositories pushed since September 2025 where the token has push permission.
2. Checks whether each repository or its organization has Actions secrets.
3. Creates the branch dependabot/github_actions/format/setup-formatter from the default branch.
4. Adds .github/workflows/codeql_analysis.yml with commit message Add CodeQL Analysis, committed as github-advanced-security[bot].
5. Waits for the workflow to complete, downloads the format-results artifact, and reads format-results.txt.
6. Deletes the workflow run and the temporary branch.

The injected workflow is named Run Copilot and does one thing: assign ${{ toJSON(secrets) }} to an environment variable, write it to format-results.txt, and upload the file as an artifact. The repository's full secrets context leaves GitHub through a legitimate-looking artifact download. Recovered npm and GitHub tokens feed back into the collector, which makes the whole loop recursive.

The workflow pins actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd and actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f, which look routine in a run log.

Credential collection

The filesystem collector reads hundreds of configured paths across Linux, macOS, and Windows: package manager tokens (npm, Yarn, PyPI, Verdaccio), cloud configuration (AWS, Azure, GCP, Alibaba, Tencent, Hetzner), Kubernetes and Helm config, .env files, shell histories, SSH private keys, VPN profiles, browser credential stores, instant messengers, crypto wallet material, AI tool credentials (OpenAI, Anthropic, Claude, Cursor, Codex, Gemini, and others), /etc/shadow, and /proc/self/environ.

The collector does not stop at files:

• It runs gh auth token to pull a GitHub token from the CLI.
• On Linux GitHub Actions runners, it uses sudo python3 to read the Runner.Worker process memory through /proc/<pid>/mem and extracts secret-store objects marked isSecret:true.
• It resolves AWS credentials from environment, profiles, web-identity tokens, ECS metadata, and IMDSv2, then enumerates Secrets Manager and SSM Parameter Store (with WithDecryption: true) across 17 regions.
• It reads all accessible Kubernetes Secrets from the in-cluster service account or kubeconfig, and enumerates HashiCorp Vault KV mounts.

Command and control

The C2 endpoint is not hardcoded in the sample. The malware calls the Ethereum mainnet contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103 through public RPC providers, using eth_call with selector 0x53ed5143. The response decodes to a list of C2 domains, contacted over HTTPS on path /router. If the contract fails, the malware searches GitHub commit messages for the marker thebeautifulmarchoftime and verifies a signed payload in a second marker, thebeautifulsnadsoftime (the misspelling is in the code), against an embedded RSA-4096 public key. Both markers make good hunting artifacts.

Exfiltrated results are serialized to JSON, gzipped, encrypted with a random AES-256-GCM key, and wrapped with an embedded RSA public key. A successful C2 response can contain a code field, which the malware passes to eval. That is full remote code execution inside the compromised process.

If direct C2 is unavailable, the sample falls back to GitHub. Using a stolen PAT, it creates a public repository named from Dune vocabulary (sardaukar, fremen, atreides, sandworm, melange, and so on) with the description Shai-Hulud: Here We Go Again, and commits encrypted results under results/. If the victim account has no organizations, the worm also publishes the victim's own PAT, double-base64 encoded, in a commit message reading IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients:<encoded-token>. Other infected hosts search public commit messages for that marker and reuse tokens that still work. This gives the campaign a decentralized fallback channel built on GitHub search.

Targeted trusted-publishing attack

The sample has one special-cased path. Inside a GitHub Actions run where GITHUB_WORKFLOW_REF contains release-drafter.yml and GITHUB_REPOSITORY contains /opensearch-js, it requests an Actions OIDC token with audience npm:registry.npmjs.org, adds a malicious optionalDependencies entry pointing at a fixed attacker commit to @opensearch-project/opensearch, exchanges the OIDC token for a publish token, and publishes. It also creates a Sigstore bundle through Fulcio and Rekor, so the malicious tarball gets valid provenance from the trusted workflow context. In that repository, other workflows exit before the general collection path runs. None of this is accidental.

Embedded but inactive capabilities

The encrypted payload set includes scripts with no call site in the observed execution path: a Bash Bun loader, a Python Bun loader, and a gh-token-monitor installer for macOS LaunchAgents and Linux user systemd. The monitor stores a GitHub token and a handler, polls the token every 60 seconds for up to 24 hours, and runs the handler when the token starts returning 4xx, presumably to act when defenders revoke it. We assess these are development or fallback capabilities. Hunt for the artifacts, but do not report them as active persistence without evidence of installation.

Evasion

Most strings use a custom position-dependent substitution cipher derived from PBKDF2-HMAC-SHA256. Larger payloads are gzipped and AES-256-GCM encrypted. Outside CI, the sample relaunches itself detached with _NODE_RUNTIME_INIT=1, holds a PID lock at /tmp/tmp.dpkg_14527.lock, installs empty SIGINT/SIGTERM handlers, swallows top-level exceptions, and exits zero. The code contains the string Exiting as russian language detected!, but its predicate always returns false. There is no active language exclusion.

Detection and Remediation guidance

JFrog Curation customers using an immaturity policy were fully protected from this attack, as all of the hijacked packages were flagged in less than 24 hours. Curation has an automatic compliance version selection (CVS) mechanism to ensure developer and CI/CD seamless fallback to compliant, non-malicious versions.

If you installed any package version in the table below, treat the host as compromised. CI runners and build machines are the highest-value targets and should be rebuilt, not cleaned.

Step 1: Isolate and preserve evidence

Isolate affected systems. Preserve package tarballs, npm logs, CI logs, GitHub audit logs, and runner images before cleanup. You will need them to bound the exposure window.

Step 2: Revoke and rotate credentials

Revoke all npm tokens available to affected users and CI jobs, starting with tokens that have bypass_2fa and write permission. Revoke GitHub PATs, OAuth tokens, and Actions tokens exposed to affected systems. Then rotate everything else present on the host or runner: AWS, Azure, GCP, Kubernetes, Vault, database, SSH, VPN, AI-service, and wallet credentials. Assume any secret the collector could read was read.

Step 3: Audit GitHub activity

Search all branches, not just default branches, for the five hook files (.vscode/tasks.json, .vscode/setup.mjs, .claude/math_init.js, .claude/settings.json, .claude/setup.mjs). Review audit logs for the commit message chore: update config, the branch dependabot/github_actions/format/setup-formatter, workflows that created and quickly deleted codeql_analysis.yml, and any run that produced a format-results artifact. Alert on any workflow that serializes ${{ toJSON(secrets) }}.

Step 4: Remove malicious packages and rebuild

Disable or remove the compromised versions listed below. Clear package-manager caches and existing node_modules trees. Rebuild CI runners and developer environments from clean images. Publish clean package versions only after publisher credentials and trusted-publishing configuration are replaced.

Step 5: Review npm trusted publishing

Review npm trusted publishers and GitHub OIDC configuration, especially release automation based on release-drafter.yml. The OpenSearch targeting shows the actor understands and abuses trusted publishing flows.

Conclusions

This Shai-Hulud variant is a credential stealer, an npm worm, and a GitHub repository infector in one payload. Its propagation does not depend on a fixed package list. One stolen npm token with broad write access can turn every package owned by that publisher into the next wave. GitHub tokens extend the loop by exposing Actions secrets and planting execution hooks where developers are likely to trigger them.

If an affected version ran in your environment, removing the package is not enough. Revoke credentials, inspect every writable repository branch, and rebuild the host or CI runner from a clean image.

Compromised packages (Ongoing)

The initial wave consisted of keyv 6.0.0, cacheable 2.5.1, and the @cacheable/* family. Because the worm republishes every package writable with the credentials it steals, the list below keeps growing. It is current as of this writing and will be updated. Xray IDs are being assigned and will be added.

Indicators of compromise (IOCs)

Files and paths

math_init.js
setup.mjs
/tmp/tmp.dpkg_14527.lock
.vscode/tasks.json
.vscode/setup.mjs
.claude/math_init.js
.claude/settings.json
.claude/setup.mjs
.github/workflows/codeql_analysis.yml
format-results.txt

GitHub artifacts

dependabot/github_actions/format/setup-formatter
chore: update config
Co-authored-by: claude <claude@users.noreply.github.com>
Add CodeQL Analysis
github-advanced-security[bot] <github-advanced-security[bot]@users.noreply.github.com>
Shai-Hulud: Here We Go Again
thebeautifulmarchoftime
thebeautifulsnadsoftime
IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients

Network and infrastructure

The npm registry, GitHub, Fulcio, Rekor, Oven Bun releases, and public Ethereum RPC providers are legitimate services abused by the malware. Do not block them based on this incident alone. Combine service access with the paths, commit messages, contract address, selector, and package mutations above.

Payload hashes