The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one

On Tuesday, an attacker gained unauthorized access to the GitHub account of the developer responsible for maintaining keyv, a widely-used key-value storage library served by npm approximately 127 million times each week. Within hours, malicious versions of keyv and its associated caching packages were uploaded to npm, containing a credential-stealing worm. By midday, security firm Aikido identified at least 868 compromised packages spanning 1,381 versions, collectively accounting for over two billion monthly installs, a number that continues to increase. JFrog also traced the attack across more than 400 packages and 1,700 tainted versions independently.

The alarming factor for security teams is not the sheer volume of downloads but rather the authenticity. The initial malicious releases were accompanied by valid provenance signatures, the cryptographic attestations intended to confirm a package’s origin. The worm did not falsify this signature; it obtained it legitimately, mimicking a genuine release.

A day earlier, CrowdStrike released its 2026 Threat Hunting Report, which foresaw this exact type of attack. A section titled “Software Supply Chain Attacks Evolve” highlighted the developer ecosystem, package registries, continuous integration pipelines, container registries, and editor extensions as primary targets for adversaries. This report emphasized npm packages, linking them to 87% of the malicious software registry threats tracked by CrowdStrike in the year’s first half. The keyv worm brought this prediction to life within a day.

For Chief Information Security Officers (CISOs) and security architects, these incidents convey a unified message: trust signals embedded in the software supply chain can be exploited by attackers with the right account access, and the time between disclosure and exploitation has shrunk beyond the efficacy of monthly patching cycles.

How the worm acquired its provenance

An examination of the mechanism reveals why provenance did not offer protection. As Aikido’s analysis shows, the attacker introduced malicious files directly to the main branch of each repository overseen by the maintainer and promptly initiated a new release. This release, processed through the maintainer’s GitHub Actions workflow, resulted in npm generating a legitimate provenance attestation. To an auditor of supply chain integrity, the tainted build appeared genuine. Wiz independently verified the release path, and in one specific case documented by JFrog, the worm advanced further. Within a GitHub Actions run linked to opensearch-js, it requested an OIDC token, swapped it for a publish token, and created a Sigstore bundle via Fulcio and Rekor, ensuring the malicious tarball carried provenance from the trusted workflow context.

The spread transformed a single account takeover into a registry-wide crisis. Once a poisoned package entered a developer’s environment or build runner, it harvested every accessible credential, using any npm publishing tokens it found to compromise other packages the victim managed. Each compromised maintainer unknowingly became a distribution point, with Aikido observing dozens of new infected packages appearing every few minutes. The malware exfiltrated stolen credentials to public GitHub repositories tagged “Shai-Hulud: Here We Go Again,” naming the campaign.

The impact extended beyond obscure utilities. Given that keyv functions as a transitive dependency beneath many popular tools, the worm infiltrated corporate npm scopes via these chains, with releases associated with Deliveroo, Qlik, and Picsart among the confirmed cases. Developers at these firms did not intentionally install keyv; they depended on other tools that required it, layers down a dependency chain rarely scrutinized manually.

The credential extractors within the payload reveal the attackers’ true target, which was not the caching libraries. JFrog, which traced the compromise through keyv and cacheable, and Wiz both identified the malware’s intent to capture cloud access keys, CI secrets, and tokens used for authenticating to production infrastructure. The package compromise served as the delivery mechanism, with the cloud being the ultimate target. CrowdStrike noted a 171% increase in cloud-focused criminal activity in the first half of 2026, partly fueled by supply chain compromises.

The target was the developer’s own tools

The theft did not end with credential harvesting; the worm also embedded itself into developers’ work environments. Wiz discovered that the malware deposited persistence payloads in two directories on any machine it reached: one for Visual Studio Code and another labeled .claude, the working directory for Anthropic’s Claude Code agent. These setup files allow the payload to activate whenever a developer opens the infected project in their editor or initiates an AI coding session, not just during installation. This is the developer ecosystem that CrowdStrike identified, precisely targeting the editors and AI assistants developers trust the most but inspect the least.

The fix costs nothing

A simple measure could have mitigated the worm, and it incurs no cost. Adam Meyers, head of Counter Adversary Operations at CrowdStrike, explained in a confidential pre-release interview: “Secure the software supply chain,” he advised. “Simple steps like preventing your tools from downloading the most recent dependencies, opting instead for last week’s versions.” The delay is crucial. “You’ll still have nearly up-to-date software, but you won’t face the risk of downloading something updated just minutes ago, potentially introducing malicious tools.” Delaying a release by a week allows the security community to identify a poisoning before it reaches every downstream build within minutes.

This recommendation is not theoretical. npm introduced this capability in February 2026 with CLI version 11.10.0, offering a setting known as min-release-age. pnpm had implemented minimumReleaseAge five months earlier. Both settings enable teams to reject any package version released more recently than a specified threshold. The keyv worm provides a compelling reason to activate it.

Meyers pairs this delay with another strategy: prioritize patching vulnerabilities that attackers are exploiting. “Focus your vulnerability mitigation and patching on exploits known to be used by attackers,” he told VentureBeat. He pointed to a resource many teams overlook. “CISA in the United States issues the Known Exploited Vulnerability Catalog,” updated weekly with vulnerabilities confirmed to be actively exploited, maintained by the government and freely accessible. “By patching these vulnerabilities first, you’re likely to enhance your security.”

Meyers highlighted the urgency of the issue with numbers not featured in the published report. In 2025, approximately 48,200 vulnerabilities were registered as CVEs. By the week preceding the briefing, 2026 had already recorded 43,000.

This volume overwhelms monthly patch cycles. “They cannot function within 30-day patch windows,” he told VentureBeat. “Once a vulnerability is disclosed, immediate action towards patching or mitigating that issue is necessary.” CrowdStrike’s report aligns this trend with a finding that 88% of exploitations against vulnerabilities with a public proof of concept occurred within 48 hours of the code becoming public.

GitHub hardened half the problem

GitHub, the owner of npm, has spent the last year strengthening the registry against this type of attack. The platform implemented mandatory two-factor authentication for publishing, revoked old non-expiring access tokens, and introduced trusted publishing, enabling build systems to push without stored credentials. Then, with npm version 12, released in mid-2026, it changed the default. Preinstall, install, and postinstall hooks, which most malware relies on to execute when a package is installed, now require explicit approval.

This change is directly relevant as the keyv worm exploits a preinstall script, and npm 12 affects both sides. JFrog confirmed that on npm 12 or newer, where preinstall hooks are disabled by default, the malware does not execute during installation. Organizations using older npm versions, which many enterprises do slowly upgrade, remained vulnerable.

GitHub’s measures strengthened the wrong aspect of the attack, making it harder for malicious packages to execute but less so to prevent an attacker from gaining publishing rights. Account takeover remains the root cause. Kiran Raj, a security engineer at Endor Labs, noted a similar pattern, where npm publishing tokens were stolen and reused, often CI or service-account tokens extracted from a build runner that had installed a compromised dependency. The worm never needed to bypass provenance. It required just one set of valid credentials, and npm’s publishing automation handled the rest.

Provenance attestation verifies whether a package originates from the claimed pipeline. It does not confirm whether the person or token initiating that pipeline was authorized. Identity governance, determining who can publish and what their credentials can access, is a weaker control. CrowdStrike identifies the misuse of legitimate developer identities as the primary entry point for supply chain compromise. Meyers stated simply, “They log in, they don’t hack in.” The keyv maintainer’s account was that entry, and the trusted-publishing process facilitated the attack on the perpetrator’s behalf.

Why the boardroom is next

The urgency to address this issue will not stem solely from threat reports. It will soon be driven by contractual obligations. Kayne McGladrey, a senior member of the IEEE, explained in an exclusive interview with VentureBeat that enterprises are beginning to impose software security responsibilities on the vendors and maintainers in their supply chains. “We’re going to see companies attempt to contractually transfer liability to other parties in their supply chain,” he told VentureBeat. “We use your technology, but we want you to ensure its security.”

He drew a parallel to how the Department of Defense mandated higher standards for its vendors through the CMMC certification program. “Improve your cybersecurity if you want to sell to us.” For companies delivering software with open-source dependencies, this translates provenance, identity, and patch practices into contractual liabilities.

What to do Monday morning

For security teams determining how to respond to this on Monday morning, actions can be divided into five strategies that correspond to the ways this attack operates. Each represents a governance decision that a board can fund and review, rather than a tool a developer installs independently.

Package counts reflect Aikido and JFrog tracking as of August 4 and were increasing at the time of reporting.

The keyv worm will eventually be contained. Compromised versions will be withdrawn, stolen tokens will be rotated, and affected packages will be republished clean. However, the nature of the exposure it uncovered will remain unchanged. The developer ecosystem is now a primary target, and the automation that enhances its productivity is the same automation that accelerates a worm’s spread. The trust signals intended to secure it can be satisfied by anyone with the correct credentials.