A sophisticated self-propagating malware campaign has struck the npm ecosystem, compromising the popular Keyv package and rapidly spreading to at least 868 packages across more than 1,380 versions. Security researchers estimate the affected packages represent over two billion monthly installs.The attack began when threat actors gained control of the GitHub account belonging to the maintainer of Keyv (a widely used key-value storage library with roughly 127 million weekly downloads). Using the compromised identity, the attackers injected malicious code directly into the main branch of several repositories under the same maintainer’s control, including Keyv, cacheable, flat-cache, and file-entry-cache.They then published new package versions through legitimate GitHub Actions workflows. Because the builds originated from the official pipelines, the malicious releases carried valid provenance attestations — making them appear fully legitimate to automated supply-chain checks.
Every compromised package received two new files — setup.mjs and Math_Symbol.js — along with a silent "preinstall": "node setup.mjs" entry in package.json.
When a developer or CI system runs npm install on an affected version, the preinstall hook executes automatically. It downloads the official Bun JavaScript runtime and uses it to launch the second-stage payload. The malware then:
Harvests cloud credentials (AWS, GCP, Azure)
Steals infrastructure secrets, HashiCorp Vault tokens, Kubernetes service-account tokens
Collects npm and GitHub authentication tokens
Targets AI-related configuration files and crypto wallets
Plants persistence mechanisms in .vscode and .claude directories so the payload can re-trigger when a developer or AI coding agent opens the repository
Once credentials are obtained, the worm uses them to republish itself into other packages owned by the compromised maintainer or newly stolen accounts, allowing rapid lateral movement across the registry.Researchers from Aikido, Upwind, Wiz, Socket, and others have linked the campaign to the ongoing Shai-Hulud family of worms (also referred to in some reports as ChainDrop).
What Developers and Organizations Should Do Immediately
Audit lockfiles for the malicious versions listed above (and any newly reported ones).
Pin exact known-good versions — avoid caret (^) or tilde (~) ranges.
Rebuild lockfiles and clear local npm caches.
Run future installs with --ignore-scripts until the situation stabilizes.
Rotate all potentially exposed secrets: npm tokens, GitHub PATs, cloud credentials, Vault tokens, CI secrets, and any AI-agent credentials.
Scan developer workstations and CI runners for the presence of setup.mjs, Math_Symbol.js, or unexpected files in .vscode / .claude directories.
Treat any machine that installed a malicious version as compromised, even if the package has since been removed.
The malicious Keyv 6.0.0 release was live for only a few hours before being rolled back, but the worm’s ability to self-propagate means the window of exposure was significantly larger for transitive dependencies.This incident once again highlights the fragility of the open-source supply chain. Even packages with valid provenance and millions of weekly downloads can become vectors when a single maintainer account is compromised.Stay vigilant, pin your dependencies tightly, and monitor official advisories from Aikido, Socket, Wiz, Upwind, and the npm security team for the latest updates.
