Keyv and friends compromised in active Shai-Hulud supply chain attack
A massive supply chain attack has compromised over 800 npm packages, including widely used utilities like Keyv, by injecting credential-stealing malware. The attackers used a compromised maintainer account to push malicious code that executes a dropper during installation.
Why it matters
This incident represents a significant security threat to the global software ecosystem, affecting billions of monthly installs and highlighting vulnerabilities in package management.
On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv , a key-value storage library with roughly 127 million weekly npm downloads, and used that access to inject credential-stealing malware across the entire package family. The same maintainer owns cacheable (29M downloads/month), flat-cache (565M downloads/month), file-entry-cache (557M downloads/month), and several other widely-used caching utilities, all of which were swept up in the same attack. The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions.
We are also also seeing very active community spread of this supply chain worm to other maintainers and packages, including major organisations:
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in