Keyv and Cacheable npm Supply Chain Compromise: Mini Shai-Hulud Worm Stealing Developer and CI/CD Credentials

On August 4, 2026, researchers disclosed a supply-chain compromise initially affecting the keyv and cacheable npm package families. The attacker reportedly compromised a maintainer’s GitHub account, force-pushed malicious files to the main branch, and immediately triggered releases through the projects’ legitimate workflow. The poisoned versions therefore carried valid build provenance: the attestations accurately described how the artifacts were built, but did not establish that the source was clean. The existing compiled output remained byte-for-byte unchanged, with the malicious behavior confined to added lifecycle files. Subsequent propagation also used stolen npm credentials to modify and publish package tarballs directly. Estimates vary by vendor and collection time, from Microsoft’s count of more than 400 affected packages across several publishers, tracked as ChainDrop, to reports of 868 packages and 1,381 versions associated with more than two billion monthly downloads. The payload is derived from Mini Shai-Hulud and shares traits with the TeamPCP and @antv campaigns, although no cited vendor attributes it to a named actor.

Each backdoored package adds a preinstall lifecycle hook that executes a small obfuscated dropper during dependency installation, allowing the malware to run on developer workstations and CI/CD runners before application code or tests begin. The dropper fingerprints the platform and, if necessary, downloads the Bun JavaScript runtime into a temporary staging directory without verifying its checksum or signature. It extracts Bun using system archive tools, transfers execution to a heavily obfuscated bundle, and deletes the staging directory. The payload exits on Russian-language systems, prevents duplicate instances, and continues as a detached background process on developer workstations.

The stealer collects credentials from local configuration, cloud metadata services, and secret-management platforms. It obtains npm tokens and validates their publishing permissions; collects GitHub personal access, OAuth, and app tokens; and, in CI environments, scans the runner process’s memory for workload-identity tokens that log masking would otherwise conceal. Its cloud coverage includes credential profiles, environment variables, instance and container metadata endpoints, and secret-store enumeration across multiple regions. It also targets Kubernetes service-account tokens, Vault credentials from several sources, payment and messaging keys, cryptocurrency wallets, AI assistant configuration, and roughly 200 filesystem patterns covering environment files, private keys, and infrastructure state. Collected data is encrypted under an operator-controlled key and exfiltrated through multiple channels: a dynamically resolved HTTPS endpoint whose candidate domains are health-checked before use, or public repositories created through compromised GitHub identities with a campaign-specific description.

Persistence and propagation both reuse trusted developer tooling. The payload places copies of its loader in Visual Studio Code and Claude configuration directories and registers two triggers: a Claude session-start hook and a VS Code task that runs when the project folder is opened. Each trigger invokes the copy stored in the other tool’s directory. Because these files reside in project configuration rather than the installed package tree, they can survive removal of the malicious dependency and affect developers who later clone and trust the repository. A user-level watcher service can also monitor the stolen GitHub token and invoke an operator-supplied handler after revocation, so responders should remove this component before rotating credentials.