In early August 2026, the npm ecosystem suffered one of the largest supply chain attacks in JavaScript history. An attacker who took over the GitHub account behind the popular keyv and cacheable packages injected malicious code and pushed out dozens of compromised releases. Through cascading dependencies, the infection — dubbed Shai-Hulud — spread to more than 1,300 versions across 434 packages with a combined monthly download count exceeding 2 billion.
How the attack unfolded
On August 4, 2026, around 09:00 UTC, the attacker pushed malicious code directly to the main branch of keyv and immediately cut new releases. The same maintainer also owned other widely used utilities such as cacheable (29 million downloads/month), flat-cache (565 million) and file-entry-cache (557 million) — a single compromised account opened the door to hundreds of projects worldwide. The malicious versions shipped with a preinstall hook that runs automatically the moment the package is installed, before any application code even starts, and downloads a much larger malicious payload.
What the malware actually does
Shai-Hulud is built as a worm: once it infects a developer’s machine, it tries to steal credentials — npm tokens, GitHub keys, cloud secrets — and uses them to automatically spread into further packages the infected developer has access to. That’s exactly why it jumped from a single source package to hundreds of others within hours; this isn’t a one-off data leak, but a self-propagating infection of the entire supply chain.
Why this matters even if you’re not a developer
Packages like keyv and cacheable are “invisible” dependencies — most companies have no idea their website or app uses them, because they were pulled in by another, directly used package. If your site or e-shop runs on Node.js frameworks, WordPress build tooling, or other JavaScript projects that were updated during the attack window, you could have been affected indirectly, no matter how carefully you guard your own code.
How to protect yourself
It’s recommended to immediately check whether your projects use the compromised versions of keyv, cacheable, flat-cache, or file-entry-cache, and either pin them to an older safe version or update to a patched one. Companies with in-house development should rotate any npm tokens and access keys that were active during the exposure window and review CI/CD logs for unusual outbound connections. For externally managed sites, the simplest path is to ask your provider whether they’ve already run the check.
Conclusion
The Shai-Hulud attack is another reminder that website security no longer stops at your own code — it also depends on who your supply chain trusts. Want to be sure someone is regularly checking your dependencies? Get in touch and we’ll audit your projects and set up monitoring that catches attacks like this early.
