400+ npm Packages Compromised in Shai-Hulud Worm Attack: What Developers Must Do Now

A malicious worm swept through the npm ecosystem on August 4, 2026, compromising over 400 packages after attackers hijacked a GitHub maintainer account. If your team uses npm—and especially if you depend on popular caching or utility libraries—your developer credentials, CI/CD tokens, and cloud secrets may already be at risk. This is not a theoretical threat: the attack is active, spreading automatically through dependency chains, and stealing real credentials right now.

What Happened: The Attack Timeline

On August 4 at 09:00 UTC, attackers gained control of a GitHub maintainer account and published malicious versions of keyv, a widely-used npm caching library with over 150 million weekly downloads. Within hours, the worm had propagated to more than 400 distinct npm packages, reaching millions of developers globally.

Wiz Research documented the full timeline: the attacker used legitimate GitHub Actions workflows and SLSA provenance signatures to make the malicious packages appear authentic. They published new versions under seemingly normal commit messages ("chore: update config"), making the poisoned packages difficult to distinguish from legitimate updates at first glance.

The affected packages span multiple categories—caching libraries, utilities, and middleware—meaning the blast radius extends far beyond the initial keyv compromise. Any downstream package that depends on these poisoned libraries is also at risk.

The Payload: What the Malware Steals

The worm uses the "Mini" Shai-Hulud malware family, previously seen in the TeamPCP and antv supply chain campaigns. Once installed, it targets and exfiltrates:

• Developer credentials and API keys — local SSH keys, GitHub tokens, npm tokens
• Cloud infrastructure secrets — AWS keys, GCP service accounts, Azure credentials
• CI/CD environment variables — build runner identities, deployment tokens
• AI-related configuration files — LLM API keys, model credentials
• Cryptocurrency wallets — private keys and seed phrases

According to Datadog Security Labs, the malware exfiltrates this data via GitHub repositories created under compromised identities. It also includes a fallback command-and-control (C2) mechanism that uses Ethereum smart contracts for dynamic domain retrieval—a sophisticated evasion technique designed to survive network-level blocking.

The attacker even embedded an intimidation string in the code: "IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients." This is a social engineering tactic meant to discourage security teams from blocking or removing the malicious packages.

How It Spreads: Worm Mechanics and Persistence

Unlike a typical one-time supply chain attack, the Shai-Hulud worm is self-propagating. Once installed in a development environment, it attempts to persist and spread through multiple vectors:

IDE-Level Hooks

The malware attempts to establish persistence via:

• Claude Code hooks (.claude directory in the project root)
• VS Code task hooks (tasks.json configuration)
• IDE-level execution that survives package updates and evades detection

These hooks ensure the malware runs every time a developer opens their IDE, even if the original malicious package is removed or updated.

Automatic Propagation

The worm includes logic to detect and compromise downstream dependencies. When installed, it scans the dependency tree and attempts to inject itself into other packages before they are published or used. This is what enabled it to spread from keyv to 400+ packages in hours.

Dead-Man’s Switch and Token Monitoring

Datadog’s analysis revealed that the payload includes a "dead-man’s switch" — a mechanism that can be selectively armed based on C2 response. If a developer revokes a stolen token, the malware detects this and can trigger additional destructive actions. This is a sophisticated anti-remediation tactic.

Who Is Affected?

If your team uses npm packages—which is nearly universal in JavaScript/Node.js development—you are potentially affected. Specifically:

• Direct users of keyv, cacheable, ecto, and the 400+ other compromised packages
• Transitive dependencies — if any of your dependencies depend on the poisoned packages
• Development environments — the malware targets developer machines, not just production servers

The 150+ million weekly downloads of affected packages means this attack has reached a massive portion of the JavaScript ecosystem.

Immediate Actions: What Developers Must Do Now

This is not a "monitor and wait" situation. Credential theft requires immediate action.

1. Audit Your Dependencies

Check your package.json and package-lock.json (or yarn.lock) for any packages published on August 4, 2026. Look specifically for:

• keyv versions published after 08:00 UTC on Aug 4
• cacheable and any other packages listed in the Wiz or Datadog advisories
• Any transitive dependencies that may have been compromised

Use npm audit to check for known vulnerabilities, and cross-reference the package publish dates against the attack timeline.

2. Rotate All Credentials Immediately

Assume that if you installed or updated any affected packages, your credentials are compromised:

• GitHub tokens — revoke and regenerate personal access tokens
• npm tokens — rotate your npm authentication tokens
• CI/CD tokens — revoke build runner credentials and regenerate
• Cloud credentials — rotate AWS keys, GCP service accounts, Azure credentials
• API keys — regenerate any API keys used in your environment
• SSH keys — if they were in your home directory, consider them compromised

Do not delay this step. Attackers may already be using stolen credentials to access your infrastructure.

3. Check for IDE Hooks

Search your local development environment for unexpected files:

• Look for .claude directories in your project root and home directory
• Check .vscode/tasks.json for unexpected task definitions
• Search for any .claude or .vscode configurations that you did not create

If found, delete them and scan your system for additional malware.

4. Monitor for Data Exfiltration

Datadog reported that stolen credentials are exfiltrated to GitHub repositories with descriptions like "Shai-Hulud: Here We Go Again." Search GitHub for repositories matching this pattern or containing your organization’s name. If you find any, they likely contain your stolen data.

5. Update and Clean

• Update all npm packages to versions published after August 4, 2026
• Remove any packages you don’t actively use
• Run a full dependency audit and consider using tools like npm audit fix to remediate known vulnerabilities
• Reinstall dependencies from scratch in a clean environment if possible

The Broader Lesson: Supply Chain Integrity Is Hard

This attack exposes a critical vulnerability in the open-source supply chain: a single compromised maintainer account can poison hundreds of downstream packages in minutes. The attacker leveraged legitimate GitHub Actions workflows and SLSA provenance signatures to make the malicious packages appear authentic—a reminder that traditional trust signals are not enough.

Key takeaways for the ecosystem:

• Hardware security keys should be mandatory for high-profile maintainer accounts
• 2FA enforcement across GitHub organizations is non-negotiable
• Automated supply chain integrity monitoring (like Datadog’s approach) is now essential
• Transitive dependency management needs better tooling and visibility

Individual developers cannot solve these systemic problems, but your organization can demand better security practices from the platforms and tools you rely on.

FAQ

Q: If I use npm, am I definitely affected?
A: Not necessarily. You’re affected if you installed or updated any of the 400+ compromised packages between August 4 and the time the attack was discovered. Check your lock files and audit history.

Q: What if I only use production dependencies, not dev dependencies?
A: The malware targets development environments and CI/CD pipelines. If you have dev dependencies that were compromised, your credentials are at risk even if your production code wasn’t directly affected.

Q: Can I just uninstall the malicious packages and move on?
A: Not yet. You must first rotate your credentials (in case they were stolen), then check for IDE hooks (which may persist even after package removal), then update to clean versions. The package removal alone is not sufficient.

Q: How long will it take to fully remediate?
A: Credential rotation is immediate (hours). Full remediation—auditing all dependencies, updating packages, scanning for hooks—may take a day or two depending on the size of your codebase and the number of credentials you need to rotate.

What This Means for Developers

The npm Shai-Hulud worm is a wake-up call: supply chain attacks are no longer theoretical. They are fast, automated, and capable of reaching millions of developers in hours. The good news is that the immediate remediation steps are clear and actionable. The hard part is doing them now, not next week.

If your team uses npm—and you should assume it does—treat credential rotation as urgent. Do not wait for your security team to tell you to do it. Do it today.

---

Meta description: 400+ npm packages compromised in Shai-Hulud worm attack stealing developer credentials. Audit dependencies, rotate tokens, check IDE hooks—immediate actions required.