Shai-Hulud NPM Worm Compromises keyv, file-entry-cache, flat-cache and Hundreds of Popular npm Packages via Maintainer Account Takeover — Threadlinqs Intelligence
As of 2026-08-04, Shai-Hulud NPM Worm Compromises keyv, file-entry-cache, flat-cache and Hundreds of Popular npm Packages via Maintainer Account Takeover is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1863 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: TeamPCP · ESPIONAGE
On August 4, 2026, attackers compromised the GitHub account of Jared Wray, the maintainer of keyv (~127M weekly downloads), file-entry-cache (~557M monthly), and flat-cache (~565M monthly), injecting
On August 4, 2026 at approximately 09:00 UTC, attackers compromised the GitHub account of Jared Wray, the maintainer of the keyv key-value storage library (~127 million weekly downloads), along with the related cacheable, flat-cache, and file-entry-cache ecosystems. The attacker pushed malicious code directly to the main branch of each repository and immediately cut new releases, carrying valid SLSA v1 provenance signatures generated by GitHub Actions under the compromised account's identity.
Each affected package received three changes: (1) injection of setup.mjs, a heavily obfuscated dropper that silently downloads the Bun JavaScript runtime (v1.3.13) from GitHub and uses it to execute the payload; (2) injection of Math_Symbol.js, a ~728KB to multi-MB obfuscated payload encrypted with AES-256-GCM gzip compression and PBKDF2-SHA256 key derivation; and (3) a preinstall hook ("node setup.mjs") added to package.json, causing automatic execution on any npm install. The commit 174f6a5 on keyv's repository touched 19 packages across the @keyv/* monorepo (compression, core, encryption, serialization, and storage packages), stripping all legitimate package.json metadata to only a files array pointing at the malicious artifacts.
The payload is a descendant of the Shai-Hulud malware family (MITRE ATT&CK ID S9008), attributed to the TeamPCP threat actor (also tracked as PCPcat, DeadCatx3, ShellForce, CipherForce, Persy_PCP). First documented in September 2025, Shai-Hulud has evolved through at least four major campaigns: V1 (initial rxnt-authentication patient zero), V2/2.0 (796+ packages, November 2025), SANDWORM_MODE (typosquatting AI developer tools, February 2026), and "The Third Coming" (@bitwarden/cli compromise, April 2026). The August 4, 2026 keyv wave represents the largest single wave by package count and download volume.
The worm's credential harvesting spans a broad range of targets: npm registry tokens from .npmrc files; GitHub CLI tokens (classic PATs, session tokens, OIDC tokens); AWS access keys from ~/.aws/credentials, environment variables, IMDS/ECS metadata; HashiCorp Vault tokens from VAULT_TOKEN env var and HTTP fallback; SSH private keys; Kubernetes service account tokens and kubeconfig; AI/LLM API keys (Anthropic, OpenAI, Google, Groq, Together, Fireworks, Replicate, Mistral, Cohere); cryptocurrency wallet keystores (Bitcoin, Ethereum, Monero, Zcash); 1Password, Bitwarden unlocked vaults; and CI/CD runner process memory (including GitHub Actions OIDC tokens from ACTIONS_ID_TOKEN_REQUEST_URL). Exfiltration uses a four-level fallback architecture: primary HTTPS POST to git-tanstack.com:443/router or npm-cache[.]com, signed-commit C2 discovery via thebeautifulmarchoftime repository, attacker-controlled GitHub dead-drop repos with Dune-themed names (sardaukar-*, sandworm-*), and victim's own GitHub account via stolen ghp_/gho_ tokens. Data is encrypted with AES-256-GCM + RSA-OAEP before exfiltration.
Persistence mechanisms include preinstall/prepare lifecycle hooks, GitHub Actions workflow injection (dependabot/github_actions/format/setup-formatter branches with malicious codeql_analysis.yml impersonating github-advanced-security[bot]), .claude/settings.json and .vscode/tasks.json injection for AI toolchain hijack, systemd user services (gh-token-monitor.service) and macOS LaunchAgents as dead-man switches that execute rm -rf ~/ on token revocation, and git global hook templates via init.templateDir. The worm also deploys a gh-token-monitor that polls api.github.com/user every 60 seconds and triggers data destruction if the token is revoked. On CI/CD runners, it targets runner process memory with sudo python3 to extract all injected secrets including masked ones.
Wiz Research, Datadog Security Labs, HEAL Security, JFrog, Phoenix Security, Cloud Security Alliance, and Unit 42 have all published technical analyses. Datadog maintains a dynamically updated CSV of compromised packages. The npm ecosystem remains under
Weaknesses (CWE)
CWE-494, CWE-829, CWE-912, CWE-269, CWE-522
Target sectors: software, technology, finance, health, government administration, ecommerce
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1078, T1059, T1546, T1543, T1548, T1027, T1036, T1553, T1552
