The Validity of The Shai-Hulud npm Worm’s Security Check

An incident occurred where an attacker gained control of the GitHub account of the developer responsible for maintaining keyv, a key-value storage library widely used by npm. This attack led to the distribution of poisoned versions of keyv and related caching packages on npm, containing a credential-stealing worm. Security firm Aikido identified 868 compromised packages across 1,381 versions, with over two billion monthly installs affected.

The concerning aspect of this attack was not just the number of downloads but the manipulation of provenance signatures. The malicious releases had valid cryptographic signatures, making them appear legitimate. This attack highlighted the vulnerability of the software supply chain, where trust signals can be easily deceived by attackers who gain access to the right accounts.

CrowdStrike had predicted such supply chain attacks in their 2026 Threat Hunting Report, emphasizing the increasing targeting of developer ecosystems by adversaries. npm packages, in particular, were identified as a significant target, with the keyv incident exemplifying this trend.

The method by which the attacker manipulated provenance was analyzed by Aikido. The attacker inserted malicious files into the main branch of repositories controlled by the maintainer, triggering legitimate releases through the maintainer’s GitHub Actions workflow. This process allowed the attacker to generate authentic provenance attestations for the poisoned packages.

The compromised packages not only aimed to steal credentials but also targeted cloud access keys, CI secrets, and production infrastructure tokens. The attack spread rapidly, infecting numerous packages across different organizations. Developers who unknowingly depended on these compromised packages were unwittingly involved in the distribution of the malware.

The attack also targeted developers’ tools by planting persistence payloads in directories used by Visual Studio Code and Anthropic’s Claude Code agent. This strategy ensured that the malware could run whenever a developer interacted with infected projects or initiated coding sessions.

To mitigate such attacks, security teams are advised to implement controls such as delaying the installation of recent dependencies, monitoring and patching known vulnerabilities promptly, and enforcing multifactor authentication for maintainers with publishing rights. Additionally, organizations should classify developer workstations and CI runners as critical assets and prioritize continuous rotation of cloud credentials.

GitHub has taken steps to enhance security by requiring two-factor authentication for publishing, revoking old access tokens, and implementing trusted publishing mechanisms. However, the focus now needs to shift towards securing the credentials that grant publishing rights, as demonstrated in the keyv attack.

Enterprises are increasingly holding vendors and maintainers accountable for software security through contractual obligations. Companies are expected to enforce better cybersecurity practices throughout their supply chains, emphasizing the importance of provenance, identity management, and patch discipline.

In conclusion, the keyv supply chain attack underscores the evolving threats faced by the developer ecosystem. It highlights the need for robust security measures, proactive vulnerability management, and continuous monitoring to safeguard against similar incidents in the future.