Affected Systems

Over 1,300 npm packages (1,381 versions) including Keyv, Cacheable, flat-cache, and file-entry-cache. Attack originated from compromised GitHub account of Keyv maintainer. Affects Node.js development environments, CI/CD pipelines, and any systems that ran npm install on poisoned package versions. Organizations using affected packages include Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.

Exploitation Status

Active exploitation confirmed. Self-propagating malware (ChainDrop/Shai-Hulud-based worm) is spreading autonomously across npm ecosystem. Malicious code executes automatically via preinstall hooks during npm install. Infostealer payload actively exfiltrating credentials to attacker-controlled GitHub repository and npm-cache[.]com domain. Attack ongoing and package count expected to grow.

Business Impact

Critical supply-chain compromise affecting Node.js development pipelines globally. Automatic execution via npm preinstall hooks means any developer or CI/CD system installing affected versions is immediately compromised. Malware steals GitHub PATs, npm tokens, AWS credentials, Kubernetes secrets, Vault tokens, database credentials, and cloud provider keys. Self-propagating capability allows lateral movement to additional packages. Valid GitHub Actions provenance makes detection difficult. Compromised credentials enable unauthorized repository access, package publishing, and cloud resource abuse.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit all Node.js projects and CI/CD pipelines for affected npm packages using IoC lists from Wiz, StepSecurity, Aikido, Socket, or Ox Security
  • Treat any system that installed compromised package versions as fully compromised; rebuild from clean backups or from scratch
  • Rotate all credentials accessible from affected environments: GitHub PATs, npm tokens, AWS keys, GCP/Azure credentials, Kubernetes secrets, Vault tokens, database passwords, and API keys
  • Search for IoC domain npm-cache[.]com in network logs and GitHub repositories with description 'Shai-Hulud: Here We Go Again' in audit logs
  • Review Git commit history and npm package publish logs for unauthorized changes or releases from compromised accounts
  • Implement dependency allowlisting, lock file integrity checks (npm ci with package-lock.json), and npm provenance verification for all future installs
  • Monitor for files named setup.mjs, Math_Symbol.js, or math_init.js and preinstall hooks executing node setup.mjs in package.json