A malicious [email protected] published at 09:35 UTC on August 4 kicked off the latest wave of the Mini Shai-Hulud npm worm lineage, self-propagating from the Keyv/Cacheable namespace into more than 400 distinct packages within roughly 30 minutes and over 860 packages across 1,381 versions within hours, per Aikido’s count. keyv alone sees around 127 million weekly downloads, and the worm’s blast radius spans multiple unrelated npm organizations rather than one publisher’s namespace.

What happened

Attackers compromised a maintainer’s GitHub/npm account and pushed [email protected] plus ten related packages carrying a hidden preinstall script. The script drops a 727,680-byte obfuscated payload that runs before any application code — before a build step, a test, or a lockfile diff would ever see it. Once running, the payload harvests GitHub PATs and Actions tokens, npm publish tokens, AWS/GCP/Azure credentials, SSH and GPG keys, and database connection strings from the local environment.

With any usable npm publish token it finds, the worm republishes itself into that maintainer’s other packages — the same self-propagation mechanism that has driven every Mini Shai-Hulud wave since the original October 2025 outbreak. That mechanism, not the initial compromise, is why a single stolen credential turned into 800+ poisoned packages in a matter of hours.

Technical details

Two things distinguish this wave from earlier Shai-Hulud variants:

Blockchain-based C2 resolution. Instead of embedding command-and-control domains in the payload — a static IOC that gets sinkholed within hours — the malware makes an eth_call against an Ethereum smart contract to retrieve its current C2 address at runtime. The operator can rotate infrastructure by updating on-chain contract state, with no need to republish the malware itself. This mirrors techniques seen in the earlier ViteVenom campaign, which pulled C2 locations from live Tron transactions.

IDE persistence hooks. The payload plants a SessionStart-style hook into Claude Code configuration and a task entry into VS Code’s .vscode/tasks.json, both scoped to fire only if the developer trusts the workspace. That trust gate means the hooks won’t fire on a blind clone-and-scan, but will fire the next time an affected developer opens the project normally — giving the worm a second execution path independent of npm install.

No CVE has been assigned; this is an account-compromise and self-propagation event, not a software vulnerability in keyv or cacheable itself.

Impact

Anyone who ran npm install (or an equivalent transitive install) against an affected keyv/cacheable-family package after 09:35 UTC on August 4 should treat every credential reachable from that machine or CI job as compromised — GitHub tokens, cloud credentials, and npm publish tokens included. CI runners are the highest-value target: a leaked npm or GitHub Actions token from a build job lets the worm republish into whatever packages that pipeline has publish rights to, extending the blast radius well past direct dependents.

Because the worm self-propagates through any compromised publish token it finds, the final package count is still moving; treat the 860+/1,381-version figure as a floor, not a ceiling.

Mitigation

  • Check installed versions against the known-bad list (Wiz, Aikido, and Socket have all published IOC and package-version trackers) and pin/downgrade any affected package.
  • Rotate every credential — GitHub PAT, npm token, cloud keys, SSH/GPG keys — that was present on any machine or CI runner that installed an affected version since 09:35 UTC August 4.
  • Audit Claude Code and VS Code workspace settings for unexpected SessionStart hooks or .vscode/tasks.json entries, particularly a folderOpen-triggered task you didn’t add.
  • Enforce --ignore-scripts or a lockfile-based install-time execution gate in CI where feasible; this entire class of worm depends on preinstall/postinstall running unreviewed code.
  • Revoke and reissue npm publish tokens for any maintainer account with commit access to the compromised namespace, and enable npm’s 2FA-for-publish where not already on.

Advisories and technical breakdowns: The Hacker News, Wiz, Aikido, Upwind, SafeDep.