Full Report
Multiple npm packages in the keyv/cacheable ecosystem were compromised following the compromise of a GitHub maintainer account, resulting in the publication of malicious package versions. All versions shared a consistent payload. Starting at 9:00 UTC, the attacker first used a...
Analysis Summary
# Incident Report: keyv and cacheable npm Package Supply Chain Hijack
## Executive Summary
A maintainer’s GitHub account was compromised, allowing an attacker to inject malicious payloads into the widely used `keyv` and `cacheable` npm ecosystems. The attack resulted in the publication of malicious package versions that functioned as a worm, successfully propagating to over 400 distinct npm packages. The primary objective involved IDE persistence and data exfiltration via a specialized tool dubbed "Mini Shai Hulud."
## Incident Details
- **Discovery Date:** August 4, 2026
- **Incident Date:** August 4, 2026
- **Affected Organization:** npm / GitHub Open Source Ecosystem
- **Sector:** Software Development / Technology
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 4, 2026, at 09:00 UTC
- **Vector:** Maintainer Account Compromise
- **Details:** An attacker gained unauthorized access to a GitHub maintainer account with publishing rights to the `keyv` and `cacheable` repositories.
### Lateral Movement
- **Supply Chain Worm:** After the initial compromise of the `keyv` repository, the attacker introduced malicious payloads that automated the compromise of downstream packages. This "worm" behavior resulted in the infection of over 400 distinct npm packages.
### Data Exfiltration/Impact
- **Payload Execution:** The malicious versions contained a consistent payload designed for data exfiltration and IDE (Integrated Development Environment) persistence.
- **Malware:** Use of the "Mini Shai Hulud" tool to facilitate malicious activities on developer machines.
### Detection & Response
- **Discovery:** Security researchers and the developer community identified unauthorized commits and unexpected package version releases.
- **Response Actions:** The incident was finalized and documented by August 5, 2026. Security teams worked to flag malicious versions and notify affected maintainers.
## Attack Methodology
- **Initial Access:** Compromised identity/credentials of a GitHub maintainer.
- **Persistence:** Injection of IDE persistence payloads to maintain access within developer environments.
- **Defense Evasion:** Use of legitimate maintainer credentials to publish "official" package updates, bypassing traditional perimeter security.
- **Credential Access:** Theft of maintainer credentials (initial vector).
- **Lateral Movement:** Supply chain compromise (upstream to downstream propagation).
- **Exfiltration:** Use of "Mini Shai Hulud" for data theft and transmission.
- **Impact:** Wide-scale supply chain compromise affecting 400+ packages.
## Impact Assessment
- **Financial:** Indirect costs related to remediation, developer downtime, and incident response for hundreds of affected projects.
- **Data Breach:** Exfiltration of sensitive data from developer environments and CI/CD pipelines.
- **Operational:** Disruption of the npm registry and build pipelines for thousands of downstream users.
- **Reputational:** Significant erosion of trust in the `keyv` and `cacheable` ecosystem and open-source supply chains generally.
## Indicators of Compromise
- **Network indicators:**
- Communications with known malicious C2 infrastructure associated with "Mini Shai Hulud" (details defanged in internal reports).
- **File indicators:**
- Malicious versions of `keyv` and `cacheable` published on 2026-08-04.
- Presence of "Mini Shai Hulud" binaries or scripts.
- **Behavioral indicators:**
- Unexpected automated commits to GitHub repositories.
- Unauthorized npm publications occurring outside of standard CI/CD schedules.
## Response Actions
- **Containment:** Revocation of the compromised maintainer's credentials and access tokens.
- **Eradication:** Removal of malicious package versions from the npm registry.
- **Recovery:** Restoration of repositories to the last known good state and issuance of clean package versions.
## Lessons Learned
- **MFA Importance:** The compromise of a single maintainer account highlights the critical need for enforced Multi-Factor Authentication (MFA) for all contributors with publish access.
- **Supply Chain Fragility:** A single upstream compromise can rapidly infect hundreds of downstream dependencies within hours.
- **Automated Monitoring:** The delay between the 09:00 UTC attack and detection suggests a need for better real-time monitoring of unauthorized repository changes.
## Recommendations
- **For Maintainers:** Enforce hardware-based MFA (WebAuthn/FIDO2) and use "Provable Builds" or OIDC-based publishing (e.g., GitHub Actions Trusted Publishing) to eliminate long-lived npm tokens.
- **For Consumers:** Utilize lockfiles (`package-lock.json`), implement dependency pinning, and use software composition analysis (SCA) tools to monitor for known malicious versions.
- **Security Policy:** Audit all accounts with write access to critical repositories and implement "least privilege" principles for CI/CD tokens.