A worm hit keyv and flat-cache, then spread to 868 npm packages in hours
An attacker compromised one maintainer's GitHub account, and a Mini Shai-Hulud worm rode preinstall scripts into keyv, flat-cache, file-entry-cache, and hundreds of downstream packages, stealing tokens and republishing itself.
868 npm packages compromised in one afternoon. The worm is still spreading through stolen publish tokens.
On August 4, 2026, an attacker took over the GitHub account of the maintainer behind keyv, flat-cache, file-entry-cache, and cacheable, and pushed a self-propagating credential stealer into some of the most downloaded utility packages on npm. By early afternoon, security firm Aikido counted at least 868 compromised packages across 1,381 versions, and the number was still climbing.
The packages you did not know you depend on
keyv alone sees roughly 127 million downloads a week. flat-cache and file-entry-cache, both direct dependencies of ESLint, each clear half a billion downloads a month. Almost nobody installs these on purpose. They arrive as transitive dependencies of tools that are in practically every JavaScript project, which is exactly what makes a compromise here worth an attacker's time: one stolen maintainer account fans out into millions of CI runs.
How the worm works
The injected versions add a preinstall script to package.json pointing at two new files, setup.mjs and Math_Symbol.js. The dropper downloads the Bun runtime and uses it to execute a heavily obfuscated 728 KB payload the moment npm install runs. The payload then goes shopping: npm tokens from .npmrc, GitHub personal access tokens and OIDC tokens, AWS credentials and Secrets Manager contents, Kubernetes service account tokens, HashiCorp Vault secrets, Stripe and Slack tokens, SSH keys, .env files, Docker configs, and Terraform state.
The self-propagation is the part that earned it the Shai-Hulud name, after the npm worm that hit the registry in September 2025. Any npm publish token it finds gets used to push infected versions of every package that maintainer controls, and stolen GitHub credentials get used to commit malicious hooks into repositories. That is how a compromise of one account became 868 packages in an afternoon: each newly stolen token seeds the next wave. Researchers are calling this variant Mini Shai-Hulud.
What to actually do
Check whether your lockfile pulled any of the poisoned versions on August 4, pin or upgrade to versions published after the cleanup, and treat any machine or CI runner that installed them as compromised: rotate npm, GitHub, cloud, and payment provider credentials rather than trying to guess which ones the payload reached. The honest caveat is that the numbers in this story are a snapshot. Aikido's count was 868 packages as of 13:20 CEST on August 4 and the download figures vary between trackers, so assume the blast radius is bigger than whatever number you read first.
Why a build studio cares
Every project we ship has a node_modules directory, and preinstall scripts run on developer laptops and CI with whatever credentials live there. This attack did not require anyone to install a suspicious package: it rode in through dependencies of dependencies of tools everyone already trusts. Scoped tokens, short-lived CI credentials, and install scripts disabled where possible are the difference between an annoying afternoon and a rotated-everything week.
Next step: read Aikido's running writeup and Wiz's analysis for indicators of compromise. If you want your build pipeline audited for exactly this failure mode, write to us at hello@gattyworks.com.