Blog
2 min read

keyv, cacheable-request and 400+ npm Packages Hit by a "Mini Shai-Hulud" Worm

In August 2026 attackers compromised a maintainer's GitHub account and published malicious versions of keyv, cacheable-request, cache-manager and other widely used npm packages. The Shai-Hulud-style worm stole cloud, CI and AI-tool credentials, persisted through Claude Code hooks and VS Code tasks, and spread to over 400 packages. How it worked and how to clean up.

In early August 2026, security researchers at Wiz and Aikido reported a supply-chain worm spreading through npm, starting with packages from the popular keyv / cacheable ecosystem — dependencies of countless Node.js apps via HTTP caching libraries. Wiz describes it as a descendant of the "Mini Shai-Hulud" malware family.

What was compromised

Wiz's report (4 August 2026) lists compromised versions including:

  • keyv 6.0.0
  • cacheable-request 13.0.20
  • cache-manager 7.2.10
  • @cacheable/utils 2.5.1
  • http-metrics-middleware 2.2.2

…plus many others, including packages in the @ornikar/* and @qlik/* scopes. The worm reached over 400 distinct npm packages. Wiz maintains the full list on GitHub.

How it worked

  • Initial access: a compromised GitHub maintainer account, used to add persistence payloads to the keyv repository and publish a malicious release.
  • Theft: cloud credentials, infrastructure secrets, developer credentials, AI-tool configuration files, crypto wallets, CI/CD secrets — with credential targets expanded by almost 70% over the open-source original.
  • Persistence: via Claude Code hooks and VS Code tasks.json — code that runs again when you open your editor or start your agent.
  • Exfiltration: to GitHub repositories created under stolen identities, with C2 addresses fetched from an Ethereum smart contract.
  • Spread: using stolen npm credentials to publish into more packages.

The persistence through coding-agent hooks is a first for many teams: your .claude/settings.json and editor task files are now part of your attack surface. (Claude Code Hooks)

Cleanup

  1. Find affected versions in every lockfile (including transitive dependencies) and CI cache, and remove them.
  2. Treat machines that installed them as compromised — rebuild developer machines' environments and CI runners.
  3. Rotate credentials: cloud, GitHub, npm, SSH, Kubernetes, Terraform, AI provider keys. (Leaked API Key: What to Do)
  4. Inspect .claude/settings.json, .vscode/tasks.json and similar files for hooks or tasks you didn't add — in repos and in your home directory.
  5. Review GitHub for unfamiliar repositories created under your account and new workflow files.
  6. Monitor for Wiz's published indicators.

Defences that would have helped

  • Lockfiles and npm ci so new malicious versions don't arrive silently. (package-lock.json Explained)
  • A minimum release age before adopting new versions — many worm versions are pulled within hours.
  • pnpm 10's default of not running dependency build scripts. (pnpm Workspaces)
  • Short-lived tokens and trusted publishing instead of long-lived npm tokens on laptops.
  • Isolating development (and coding agents) from your most valuable credentials. (npm Supply Chain Security)

September brought another worm, this time in AI-agent packages. (MemTensor sckit Worm)

Source: Wiz: keyv and cacheable npm packages hijacked · Aikido: Keyv and friends compromised

EasySpawn runs each project on its own isolated server, keeping a compromised dependency away from your laptop's keys and your other projects. See how it works or join the waitlist.

Related: npm audit Explained · Secret Scanning · Dependabot Explained · SBOMs and Signed Images

Keep reading