A large-scale supply chain attack has occurred targeting a popular group of npm packages with a combined monthly installation count exceeding 2 billion.

A massive supply chain attack has occurred in the JavaScript package management service 'npm,' in which malware that steals authentication credentials has been infiltrated into hundreds of widely used packages. According to security firm Aikido Security, as of August 4, 2026, at least 434 packages across 1,381 versions have been confirmed to be compromised, with the combined monthly installation count of these packages exceeding 2 billion.

Keyv and friends compromised in active Shai-Hulud supply chain attack

https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack

When developers add packages via npm, other packages that the package uses internally may also be automatically installed. Because components that developers didn't directly select are incorporated into the software, if malicious code is mixed into a widely used package, the damage can spread to numerous development environments and services through dependencies. This method of infiltrating the supply chain of components that support development and operations and attacking organizations that use those components is called a 'supply chain attack.' A major problem is that, from the user's perspective, it looks like they simply installed the software normally from a legitimate source, making it difficult to notice anything unusual.

The attack originated from the GitHub account of a developer who manages 'Keyv,' a library that stores data in key-value format. The attacker directly added malicious files to the main development branch and immediately published a new version. Because GitHub Actions, a legitimate automated processing platform, was used for the publication process, the tampered package also had a signature indicating that it was created through the proper procedures.

The first major compromised versions identified included version 6.0.0 of 'Keyv,' downloaded approximately 604 million times per month; version 6.1.24 of 'flat-cache,' downloaded approximately 580 million times; and version 11.1.6 of 'file-entry-cache,' downloaded approximately 571 million times. The attacks were not limited to packages owned by the same administrator, but spread to packages managed by other developers and companies using stolen credentials.

The compromised package had files named 'setup.mjs,' 'Math_Symbol.js,' and 'math_init.js' added to it, and it was configured to run setup.mjs before installation. When a user installs the target version using npm, setup.mjs is automatically executed before the installation is complete. setup.mjs downloads the JavaScript execution environment Bun and launches Math_Symbol.js, which steals authentication information.

Math_Symbol.js targets access tokens for npm and GitHub, Amazon Web Services credentials, and sensitive information stored in Kubernetes and HashiCorp Vault. Configuration files, SSH keys, database connection information, and Stripe and Slack tokens are also among the targets. The stolen data is encrypted and then sent to a public GitHub repository prepared by the attacker.

The malware also possessed a self-replicating function, which involved using stolen npm tokens to search for packages with public access privileges, adding malicious files and auto-execution settings, updating the version number, and republishing them as compromised packages. Furthermore, configuration files that Visual Studio Code and the AI coding tool 'Claude Code' automatically loaded were added to the GitHub repository, creating a mechanism where malicious code would automatically execute if a developer opened the compromised repository in Visual Studio Code or launched Claude Code within the repository.

Aikido Security recommends that users review their malware detection results and perform manual rescans. They also recommend 'Aikido Safe Chain,' an open-source tool that monitors the installation process of npm and Yarn to check for risks before packages start running on terminals or in automated build environments. As of the time of writing, infections are continuing to spread to other administrators and packages, and the number of affected packages may increase further.