Major Shai Hulud campaign strikes npm again, affecting keyv and 400+ packages | JFrog

The JFrog security research team identified a new version of the Shai-Hulud supply-chain malware affecting 400+ packages across 1700+ versions. The compromise started with the keyv and cacheable npm packages. Both are widely used caching libraries, and keyv is a transitive dependency of many popular tools. If you installed a compromised version, assume your environment is affected. This is an ongoing investigation. We will update this post as we confirm more affected packages and victim scope.

Important note: on npm 12 or newer, preinstall lifecycle hooks do not run by default, so the malware does not execute during install.

We analyzed a 710 KB JavaScript payload from the infected keyv@6.0.0 package. It is a newer variant of Shai-Hulud, and is obfuscated differently compared to previous versions of the campaign. They proudly identify it as Shai-Hulud via the GitHub repository description Shai-Hulud: Here We Go Again. It has four connected objectives:

1. Collect local, CI, cloud, Kubernetes, and Vault secrets.
2. Exfiltrate encrypted results through a dynamic HTTPS endpoint or attacker-created public GitHub repositories.
3. Use stolen npm credentials to publish infected patch releases of every writable package.
4. Use GitHub credentials and GitHub Actions to infect repositories and steal more credentials.

The analyzed sample's SHA-256 is 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc.

An infected package runs node setup.mjs during preinstall. The loader is a small Node.js bootstrap that works on Linux, macOS, and Windows. It uses an installed bun executable when available. Otherwise it downloads Bun 1.3.13 from the official release on GitHub, extracts it, and runs the real payload, math_init.js. They remove the temporary Bun copy right afterwards.

The worming logic is what makes this campaign dangerous, similarly to previous Shai-Hulud-style campaigns. When the collector finds an npm token, it validates the token before exfiltration even completes. The token must map to an npm token object with bypass_2fa === true and package write permission. For every package writable with that token, the worm:

1. Downloads the current latest tarball.
2. Copies the running sample to package/math_init.js.
3. Writes the loader to package/setup.mjs.
4. Replaces the package's complete scripts object and sets scripts.preinstall to node setup.mjs.
5. Increments the patch version.
6. Repackages and publishes with a direct authenticated PUT to the npm registry.

The worm also commits five files to GitHub branches it can reach:

.vscode/tasks.json
.vscode/setup.mjs
.claude/math_init.js
.claude/settings.json
.claude/setup.mjs

The configuration is mutually reinforcing. .vscode/tasks.json defines an Environment Setup task that runs node .claude/setup.mjs when a folder opens. .claude/settings.json defines a SessionStart hook that runs node .vscode/setup.mjs. Both setup files contain the Bun bootstrap, and .claude/math_init.js is the worm. Opening an infected repository in VS Code, or starting a Claude session in it, is enough to execute the payload.

Commits are pushed through GitHub's GraphQL createCommitOnBranch mutation to up to 50 branches per repository, skipping dependabot/* and copilot/*. The commit message is chore: update config with a forged Co-authored-by: claude <claude@users.noreply.github.com> trailer (even though it was not committed by Claude). Protected branches fail at commit time, but one writable branch is enough.

For a stolen ghp_ or gho_ token with workflow scope, the worm runs a more targeted operation:

1. Enumerates up to 100 repositories pushed since September 2025 where the token has push permission.
2. Checks whether each repository or its organization has Actions secrets.
3. Creates the branch dependabot/github_actions/format/setup-formatter from the default branch.
4. Adds .github/workflows/codeql_analysis.yml with commit message Add CodeQL Analysis, committed as github-advanced-security[bot].
5. Waits for the workflow to complete, downloads the format-results artifact, and reads format-results.txt.
6. Deletes the workflow run and the temporary branch.

The injected workflow is named Run Copilot and does one thing: assign ${{ toJSON(secrets) }} to an environment variable, write it to format-results.txt, and upload the file as an artifact. The repository's full secrets context leaves GitHub through a legitimate-looking artifact download. Recovered npm and GitHub tokens feed back into the collector, which makes the whole loop recursive.

The workflow pins actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd and actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f, which look routine in a run log.

The filesystem collector reads hundreds of configured paths across Linux, macOS, and Windows: package manager tokens (npm, Yarn, PyPI, Verdaccio), cloud configuration (AWS, Azure, GCP, Alibaba, Tencent, Hetzner), Kubernetes and Helm config, .env files, shell histories, SSH private keys, VPN profiles, browser credential stores, instant messengers, crypto wallet material, AI tool credentials (OpenAI, Anthropic, Claude, Cursor, Codex, Gemini, and others), /etc/shadow, and /proc/self/environ.

The collector does not stop at files:

• It runs gh auth token to pull a GitHub token from the CLI.
• On Linux GitHub Actions runners, it uses sudo python3 to read the Runner.Worker process memory through /proc/<pid>/mem and extracts secret-store objects marked isSecret:true.
• It resolves AWS credentials from environment, profiles, web-identity tokens, ECS metadata, and IMDSv2, then enumerates Secrets Manager and SSM Parameter Store (with WithDecryption: true) across 17 regions.
• It reads all accessible Kubernetes Secrets from the in-cluster service account or kubeconfig, and enumerates HashiCorp Vault KV mounts.

The C2 endpoint is not hardcoded in the sample. The malware calls the Ethereum mainnet contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103 through public RPC providers, using eth_call with selector 0x53ed5143. The response decodes to a list of C2 domains, contacted over HTTPS on path /router. If the contract fails, the malware searches GitHub commit messages for the marker thebeautifulmarchoftime and verifies a signed payload in a second marker, thebeautifulsnadsoftime (the misspelling is in the code), against an embedded RSA-4096 public key. Both markers make good hunting artifacts.

Exfiltrated results are serialized to JSON, gzipped, encrypted with a random AES-256-GCM key, and wrapped with an embedded RSA public key. A successful C2 response can contain a code field, which the malware passes to eval. That is full remote code execution inside the compromised process.

If direct C2 is unavailable, the sample falls back to GitHub. Using a stolen PAT, it creates a public repository named from Dune vocabulary (sardaukar, fremen, atreides, sandworm, melange, and so on) with the description Shai-Hulud: Here We Go Again, and commits encrypted results under results/. If the victim account has no organizations, the worm also publishes the victim's own PAT, double-base64 encoded, in a commit message reading IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients:<encoded-token>. Other infected hosts search public commit messages for that marker and reuse tokens that still work. This gives the campaign a decentralized fallback channel built on GitHub search.

The sample has one special-cased path. Inside a GitHub Actions run where GITHUB_WORKFLOW_REF contains release-drafter.yml and GITHUB_REPOSITORY contains /opensearch-js, it requests an Actions OIDC token with audience npm:registry.npmjs.org, adds a malicious optionalDependencies entry pointing at a fixed attacker commit to @opensearch-project/opensearch, exchanges the OIDC token for a publish token, and publishes. It also creates a Sigstore bundle through Fulcio and Rekor, so the malicious tarball gets valid provenance from the trusted workflow context. In that repository, other workflows exit before the general collection path runs. None of this is accidental.

The encrypted payload set includes scripts with no call site in the observed execution path: a Bash Bun loader, a Python Bun loader, and a gh-token-monitor installer for macOS LaunchAgents and Linux user systemd. The monitor stores a GitHub token and a handler, polls the token every 60 seconds for up to 24 hours, and runs the handler when the token starts returning 4xx, presumably to act when defenders revoke it. We assess these are development or fallback capabilities. Hunt for the artifacts, but do not report them as active persistence without evidence of installation.

Most strings use a custom position-dependent substitution cipher derived from PBKDF2-HMAC-SHA256. Larger payloads are gzipped and AES-256-GCM encrypted. Outside CI, the sample relaunches itself detached with _NODE_RUNTIME_INIT=1, holds a PID lock at /tmp/tmp.dpkg_14527.lock, installs empty SIGINT/SIGTERM handlers, swallows top-level exceptions, and exits zero. The code contains the string Exiting as russian language detected!, but its predicate always returns false. There is no active language exclusion.

JFrog Curation customers using an immaturity policy were fully protected from this attack, as all of the hijacked packages were flagged in less than 24 hours. Curation has an automatic compliance version selection (CVS) mechanism to ensure developer and CI/CD seamless fallback to compliant, non-malicious versions.

JFrog Xray users can check if any of their artifacts are affected by using the new Label Impact Search, with the label Shai-Hulud: Cacheable and Keyv -

If you installed any package version in the table below, treat the host as compromised. CI runners and build machines are the highest-value targets and should be rebuilt, not cleaned.

Isolate affected systems. Preserve package tarballs, npm logs, CI logs, GitHub audit logs, and runner images before cleanup. You will need them to bound the exposure window.

Revoke all npm tokens available to affected users and CI jobs, starting with tokens that have bypass_2fa and write permission. Revoke GitHub PATs, OAuth tokens, and Actions tokens exposed to affected systems. Then rotate everything else present on the host or runner: AWS, Azure, GCP, Kubernetes, Vault, database, SSH, VPN, AI-service, and wallet credentials. Assume any secret the collector could read was read.

Search all branches, not just default branches, for the five hook files (.vscode/tasks.json, .vscode/setup.mjs, .claude/math_init.js, .claude/settings.json, .claude/setup.mjs). Review audit logs for the commit message chore: update config, the branch dependabot/github_actions/format/setup-formatter, workflows that created and quickly deleted codeql_analysis.yml, and any run that produced a format-results artifact. Alert on any workflow that serializes ${{ toJSON(secrets) }}.

Disable or remove the compromised versions listed below. Clear package-manager caches and existing node_modules trees. Rebuild CI runners and developer environments from clean images. Publish clean package versions only after publisher credentials and trusted-publishing configuration are replaced.

Review npm trusted publishers and GitHub OIDC configuration, especially release automation based on release-drafter.yml. The OpenSearch targeting shows the actor understands and abuses trusted publishing flows.

This Shai-Hulud variant is a credential stealer, an npm worm, and a GitHub repository infector in one payload. Its propagation does not depend on a fixed package list. One stolen npm token with broad write access can turn every package owned by that publisher into the next wave. GitHub tokens extend the loop by exposing Actions secrets and planting execution hooks where developers are likely to trigger them.

If an affected version ran in your environment, removing the package is not enough. Revoke credentials, inspect every writable repository branch, and rebuild the host or CI runner from a clean image.

The initial wave consisted of keyv 6.0.0, cacheable 2.5.1, and the @cacheable/* family. Because the worm republishes every package writable with the credentials it steals, the list below keeps growing. It is current as of this writing and will be updated. Xray IDs are being assigned and will be added.

For some Go modules, Version uses >= <first affected> to mean that version and all later versions are compromised.

math_init.js
setup.mjs
/tmp/tmp.dpkg_14527.lock
.vscode/tasks.json
.vscode/setup.mjs
.claude/math_init.js
.claude/settings.json
.claude/setup.mjs
.github/workflows/codeql_analysis.yml
format-results.txt

dependabot/github_actions/format/setup-formatter
chore: update config
Co-authored-by: claude <claude@users.noreply.github.com>
Add CodeQL Analysis
github-advanced-security[bot] <github-advanced-security[bot]@users.noreply.github.com>
Shai-Hulud: Here We Go Again
thebeautifulmarchoftime
thebeautifulsnadsoftime
IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients

The npm registry, GitHub, Fulcio, Rekor, Oven Bun releases, and public Ethereum RPC providers are legitimate services abused by the malware. Do not block them based on this incident alone. Combine service access with the paths, commit messages, contract address, selector, and package mutations above.