An active compromise campaign by the software release chain called Shai-Hulud is distributing malware through compromised versions of legitimate packages published in the npm ecosystem.

The new wave was identified on August 4, 2026 and came with widely used packages, such as keyv, cacheable and related components. At this time, more than 400 packages have been identified and more than 1,700 compromised verses have been identified. As malware has the ability to spread automatically, the list continues to be updated.

The attack occurs in the following way:

1. A malicious version is published on npm using a legitimate package;
2. The project installs this version directly or through a transitive dependency;
3. During installation, the package tries to execute a script called preinstall;
4. The preinstall starts the setup.mjs file;
5. The file uses Node.js and the Bun runtime to execute the main payload of the malware;
6. The malware seeks access to credentials and information on the machine or non-runner;
7. The collected data is encrypted and sent to the attacker's controlled infrastructure;
8. Stolen npm and GitHub tokens can be used to compromise other packages and repositories.

It is not necessary to start the application, import the package code or receive an external request. If a malicious script is allowed during installation, the compromise may occur even in the development or build environment.

What impact for your products?What impact for your products?

The malware is a variant that targets:

• Credential routing: npm token exposure, GitHub, CI/CD, cloud, Kubernetes, Vault, Docker, data banks and SSH keys.
• Compromise of repositories: alteration of branches, workflows and configuration files used by development tools.
• CI/CD Commitment: access to runners, secrets, build processes, publication of packages, images and deploys.
• Propagation for other packages: npm tokens with written permission can be used to publish new malicious versions.
• Infrastructure Compromise: Credentials found can allow access to AWS, Azure, GCP, Kubernetes, Vault, registries and other environments.
• Remote command execution: The attacker controlled server can send additional code for execution in a compromised environment.
• Compromise of artifacts: Docker images, internal packages, releases and other artifacts produced during a janela de exposição podem ter their integritye afetada.
• Impact proportional to the privilege: The range of the attack depends on the permissions of the user, runner and tokens found. Environments with excessive credentials may have significantly higher risk.