---
title: "“Old Father Eternity”: Shai-Hulud Worm Strikes a 6th Time – keyv/cacheable npm Supply Chain Attack"
date: "2026-08-05T20:32:41+00:00"
url: "https://checkmarx.com/zero-post/shai-hulud-npm-supply-chain-attack-keyv-cacheable/"
description: "A new Shai-Hulud npm supply chain attack has compromised popular packages including Keyv and Cacheable, stealing credentials, spreading across thousands of dependencies, and infecting GitHub repositories. Learn the affected packages, IoCs, and remediation steps."
---

# “Old Father Eternity”: Shai-Hulud Worm Strikes a 6th Time – keyv/cacheable npm Supply Chain Attack

As you may have heard, a recent Shai-Hulud variant is threatening the npm ecosystem. This new (but familiar) supply chain credential stealer and worm now targets highly popular packages, most noticeably keyv and cacheable, before spreading again to thousands of other dependent packages while stealing as much secrets and credentials as it goes.

We promptly notified our customers and shared guidance to help them assess and mitigate potential exposure. Now that we are confident they are aware of the threat, we are making this information available publicly.

I**f you’re in a hurry, you can find the list of affected packages and versions in [this gist](https://gist.github.com/cx-bruno-dias/c5f3da08add5389f37b6273ee7f90278), and a list of IoCs of the current variant of Shai-Hulud in [this gist](https://gist.github.com/cx-bruno-dias/faaa377449485f5a2f8510bb61bd4f88).**  ## Ongoing Events So Far

Checkmarx Zero has been tracking a new viral malware campaign against a large and growing number of NPM packages. This is an active and rapidly developing attack following up on the Mini Shai-Hulud campaigns from recent months.

As with those attacks, this Shai Hulud campaign is a supply chain attack involving various packages on NPM, this time **including the very popular keyv and cacheable packages** as a main vector for spreading to other packages**.** At the time of publishing, it has spread to 443 unique packages spanning 2335 versions in the NPM ecosystem.

**This situation requires live monitoring from your security teams** to ensure the contagion has not spread to your organization via an automated or manual installation or update of an NPM package affected by this campaign.

**Checkmarx Zero is actively monitoring the situation and will provide updates if any new information arises.**

## Attack Overview

The malware’s goal is the theft of credentials and secrets from more than 200 file paths, cloud metadata endpoints, and environment variables, followed by self-propagation through npm packages and GitHub repositories. A single execution on a compromised developer machine or pipeline runner can result in downstream infection of every package the victim maintains and every repository they have write access to.

## Attack Chain

Upon execution the malware proceeds through six sequential phases:

**1. Environment Assessment –** Before anything, the malware checks whether it is running inside its own target CI pipeline (named *opensearch-js*), exits silently if a Russian system locale is detected, detaches itself into the background if running interactively, and enforces a single-instance lock disguised as a dpkg lock file. These checks ensure it runs exactly once, silently, and never on systems the attacker wishes to protect.

**2. Credential Harvesting –** Three collectors fire in parallel. A filesystem scanner reads from over 200 hardcoded credential file paths across Linux, macOS, and Windows – covering AWS, Azure, GCP, Kubernetes, HashiCorp Vault, SSH keys, npm tokens, GitHub CLI tokens, cryptocurrency wallets, and credentials for AI development tools including Claude, Cursor, OpenAI, and Anthropic. A shell scanner captures the entire process environment. A third scanner, active only on GitHub Actions Linux runners, reads the runner agent’s process memory and extracts repository and organization secrets that are never exposed to workflow steps.

![Overview of the amount of credential files tapped](https://checkmarx.com/wp-content/uploads/2026/08/Figure-1.webp "Figure 1 - Overview of the amount of credential files tapped")*Figure 1 – Overview of the amount of credential files tapped* **3. C2 Pipeline Creation –** The malware resolves its command-and-control infrastructure domain through three independent channels. The primary channel queries an Ethereum smart contract – this technique makes traditional domain takedown ineffective, because once a takedown occurs a new C2 can be created and the smart contract can be updated with its new address. The secondary channel searches GitHub’s public commit API for commits signed with an attacker-controlled RSA key and extracts the domain from the verified payload. The tertiary channel, used when both network options fail, creates a randomly named public GitHub repository using the stolen user’s token and commits stolen data directly to it. Every successful exfiltration call also evaluates a code field from the server’s response, giving the attacker persistent remote code execution on any machine that checks in.

![Extraction of C2 domain from Ethereum Smart Contract ](https://checkmarx.com/wp-content/uploads/2026/08/Figure-2.webp)Figure 2 – Extraction of C2 domain from Ethereum Smart Contract **4. Deep Infrastructure Sweep –** With a stable C2 infrastructure established, the malware deploys additional collectors against AWS SSM Parameter Store and Secrets Manager across all 17 regions, Kubernetes secrets across all non-system namespaces, and HashiCorp Vault through multiple authentication methods. For each valid GitHub token discovered, it additionally triggers a fake CodeQL workflow committed under the *github-advanced-security\[bot\]*identity to exfiltrate Actions secrets from target repositories, cleaning up the branch and running after extraction.

![Deep extraction of AWS credentials from AWS endpoints](https://checkmarx.com/wp-content/uploads/2026/08/Figure-3.webp)*Figure *3* – Deep extraction of AWS credentials from AWS endpoints* **5. npm Supply-Chain Propagation –** For each valid npm token with publish rights, the malware downloads the latest tarball of every writable package, injects itself as `math\_init.js`, adds a preinstall hook pointing to an encrypted dropper script (`setup.mjs`), bumps the patch version, and republishes.

![Overview of the Malware Injection into the Package Tarball](https://checkmarx.com/wp-content/uploads/2026/08/Figure-4.webp)*Figure 4 – Overview of the Malware Injection into the Package Tarball* **6. GitHub Repository Infection –** For each valid GitHub token captured, the malware pushes five files to every accessible branch of every writable repository, with commits authored as *claude@users.noreply.github.com* to impersonate Anthropic’s Claude GitHub bot:

- The malware itself as `.claude/math\_init.js`

- A dropper as `.claude/setup.mjs` and `.vscode/setup.mjs`

- A malicious VSCode tasks file

- A forged Claude AI settings file.

![Overview of GitHub Actions Secrets Exfiltration via Fake CodeQL Workflow](https://checkmarx.com/wp-content/uploads/2026/08/Figure-5.webp)*Figure *5* – Overview of GitHub Actions Secrets Exfiltration via Fake CodeQL Workflow* ## Containment and Remediation

We strongly recommend the following immediate containment and remediation actions:

- **Check for affected packages and stop npm updates – validate no affected packages and versions are actively used in your ecosystem; if affected packages are being used but not of the affected versions, stop updates to ensure no malicious version is installed from NPM. The set of affected packages and versions are changing rapidly, and lists are available for any impacted package via our MPI API and the list posted in [this gist](https://gist.github.com/cx-bruno-dias/c5f3da08add5389f37b6273ee7f90278).

- **Rotate credentials across your entire developer toolchain – This malware targets over 200 credential file paths including AWS, Kubernetes, HashiCorp Vault, SSH keys, GitHub tokens, and AI developer tools. Any developer or CI runner that may have executed an affected package should be treated as fully compromised. Rotate all your secrets, not just npm and GitHub tokens.

- **Audit GitHub Actions run history – If any runner executed an affected package, assume all Actions secrets in that repository are compromised and rotate them. Additionally, check your repositories for specific malware files: a workflow named `codeql\_analysis.yml` commited under *github-advanced-security\[bot\]* and branches named “dependabot/github\_actions/format/setup-formatter”. Both are deleted after execution but may still appear in history.

- **Monitor the known IoCs – check for files named `setup.mjs`, `math\_init.js`, and `Math\_Symbol.js`, as well as the known C2 domains we provide below. Look for all our updates in [this gist](https://gist.github.com/cx-bruno-dias/faaa377449485f5a2f8510bb61bd4f88).

- **Continually scan** – if you have the Malicious Package Protection capability or an SCA solution, you can scan your entire Javascript/NPM footprint routinely to ensure that you get up-to-date information.

- **Upgrade npm CLI to v12+ and migrate to Trusted Publishing – [npm is rotating write-scoped Granular Access Tokens that bypass 2FA in response to this incident](https://x.com/npmjs/status/2084741197285978428). Upgrading to npm CLI v12+ and adopting Trusted Publishing eliminates the long-lived tokens this malware specifically targets.

- **Proactively defend every environment where packages are installed** **–** Developer workstations, CI/CD systems, and build environments are all potential infection points. npm v12 now blocks install scripts from executing unless explicitly approved, which directly addresses the `preinstall` hook this malware relies on to execute. For environments that cannot upgrade immediately, use `npm install –dry-run` feature to check what would be installed and validate those packages against a malicious package database before proceeding.

- **Centralize dependency management through a package manager proxy – Deploy a private registry proxy such as JFrog Artifactory, Sonatype Nexus, or Azure Artifacts between your developers and the public npm registry. This creates a single enforcement point where malicious packages can be blocked before they reach developer machines or CI runners and prevents regression once a dangerous version is blocked. For a detailed implementation guide covering these controls, see [Protecting yourself against malicious open-source packages](https://checkmarx.com/zero-post/protecting-yourself-against-malicious-open-source-packages/) on the Checkmarx Zero blog.

- **Enforce a minimum package release age** – Introduce a waiting period before newly published package versions can be installed or approved. This gives security tools and researchers time to identify suspicious releases before they reach developer environments or CI/CD pipelines. Where supported, configure a 24-hour delay and tightly control exceptions for urgent updates. [pnpm 11 includes a built-in 24-hour minimum release age](https://pnpm.io/supply-chain-security); however, its default behavior is non-strict for backward compatibility, so organizations should explicitly configure and enforce the policy where appropriate.

## Affected Packages and Versions

We are updating the list of packages to ensure scans via our Malicious Packages API will detect all affected packages in real time, as well as keeping a public live list of packages in the following github gist:
[https://gist.github.com/cx-bruno-dias/c5f3da08add5389f37b6273ee7f90278](https://gist.github.com/cx-bruno-dias/c5f3da08add5389f37b6273ee7f90278)
Here are just a few examples of major impacted packages – there are hundreds more and the count is growing rapidly:

**Package**

**Malicious Version**

**Weekly Downloads**

keyv

6.0.0

155,149,373 downloads

flat-cache

6.1.24

150,557,268 downloads

file-entry-cache

11.1.6

148,235,645 downloads

cacheable-request

13.0.20

33,974,774 downloads

@cacheable/utils

2.5.1

8,776,474 downloads

cacheable

2.5.1

7,932,683 downloads

@cacheable/memory

2.2.1

7,232,515 downloads

cache-manager

7.2.10

4,286,010 downloads

**Note:** All the above versions have now been removed from npm.

## Indicators of Compromise (IoCs)

We are maintaining an updated live list of IoCs in the following GitHub gist:
[https://gist.github.com/cx-bruno-dias/faaa377449485f5a2f8510bb61bd4f88](https://gist.github.com/cx-bruno-dias/faaa377449485f5a2f8510bb61bd4f88). The following are the main indicators that you should be monitoring.

### Files

- `Math\_Symbol.js` and `math\_init.js` (both share the same content)
    - SHA256 – 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc
    - SHA1 – e65b155ce74f3f81fb7d2b5b60f8e62b36e6d69c
- `setup.mjs`
    - SHA256 – 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668
    - SHA1 – 35a672cf34b996b91f3e1c28cbf3a05a37e036e4

### Network

- Domains
    - npm-cache\[.\]com
    - awqhnjewqjkl\[.\]icu
- URI Path
    - /router

### Blockchain / Smart Contract

- Ethereum Address – 0xE1f2395ee43e45A1556EC6438a88c31B83493103

### **GitHub**

- Repository Description – “Shai-Hulud: Here We Go Again”

- Fake committer – `github-advanced-security\[bot\] [&lt;github-advanced-security\[bot\]@users.noreply.github.com&gt;`](mailto:<github-advanced-security[bot]@users.noreply.github.com>`)

- Branch name: “dependabot/github\_actions/format/setup-formatter”

- Malicious workflow file: `.github/workflows/codeql\_analysis.yml`

## Conclusion

This iteration of the Shai-Hulud worm has so far been very successful in its goals, compromising hugely popular packages and spreading dramatically fast to other packages and into organizations. The full impact of the campaign is still unfolding, and its blast radius may continue to expand in the coming days and weeks.

However, developers, organizations, and package ecosystem maintainers can take meaningful steps to strengthen their defenses against similar attacks. Improving AppSec practices, securing the software supply chain, and continuously scanning and monitoring development pipelines can help ensure malicious packages are quickly identified, blocked, and mitigated. Shai-Hulud is a loud and persistent wake-up call where open-source supply chain security requires continuous vigilance.

 [linkedin-app Share on LinkedIn](https://linkedin.com/sharing/share-offsite/?url={url}) [  Share on Bluesky](https://bsky.app/intent/compose?text=I%20just%20read%20%22{title}%22%20from%20Checkmarx%20Zero%20{url})

Follow [Checkmarx Zero](https://checkmarx.com/zero/): [linkedin-app ](https://linkedin.com/showcase/checkmarx-zero) [  ](https://bsky.app/profile/checkmarxzero.bsky.social) [ ](https://x.com/CheckmarxZero)