Summary
The Shai-Hulud supply chain attack compromised the keyv maintainer's account to inject a self-propagating worm into hundreds of npm packages, stealing cloud credentials and developer secrets from over 2 billion monthly installs.
Take Action:
If you use keyv, cacheable, cache-manager, flat-cache or related packages, immediately remove the malicious versions from all developer machines and CI/CD pipelines, and treat any machine that ran an install as fully compromised. Rebuild it and revoke (not just rotate) your npm, GitHub, cloud and other keys, and delete the hidden persistence files (~/.local/bin/gh-token-monitor.sh, ~/.config/gh-token-monitor/, the LaunchAgent/systemd service, and the hooks in .claude/settings.json and .vscode/tasks.json) before issuing new credentials.
Going forward, turn off npm install lifecycle scripts by default (npm config set ignore-scripts true) and pin your dependencies, because that single setting would have stopped this attack before it started and don't rely on signed provenance to tell you a package is safe, since this one was signed by the real build pipeline.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)