Keyv and friends compromised in active Shai-Hulud supply chain attack

4 hours ago

On August 4, 2026, attackers compromised the GitHub account of the maintainer of keyv (127M weekly npm downloads) and used it to inject credential-stealing malware across the entire package family, including cacheable, flat-cache, file-entry-cache, and others.
Malicious files (setup.mjs and Math_Symbol.js) were pushed to the main branch and new releases were published with valid npm provenance signed by GitHub Actions.
The worm spread to at least 868 packages (1381 versions) with over 2 billion monthly installs, including packages from major organizations like Deliveroo, Picsart, and Qlik.
The payload (Math_Symbol.js) is a 728 KB obfuscated JavaScript file that steals npm tokens, GitHub tokens, AWS credentials, Kubernetes secrets, HashiCorp Vault tokens, Stripe/Slack tokens, and performs a generic filesystem scan using over 200 glob patterns.
The malware uses a preinstall script in package.json to execute setup.mjs, which downloads the Bun JavaScript runtime to run the real payload, exfiltrating stolen data to a public GitHub repository.
Aikido detects this as a critical malware issue (100/100) and offers free malware scanning, device protection, and an open-source tool (Safe Chain) to intercept package installs and check against Aikido Intel.

PolinRider is a DPRK-linked supply-chain campaign that takes over legitimate GitHub accounts and injects obfuscated JavaScript loaders into repositories.
Initially confined to GitHub, the campaign expanded to multiple package ecosystems including Packagist, Go modules, npm, and PyPI without evolving its malware.
Ecosystems like Go and Packagist are particularly vulnerable because they resolve packages directly from Git repos, making GitHub account takeovers equivalent to publishing access.

Shai-Hulud is an npm supply-chain malware by TeamPCP, named after the sandworms from Dune, which compromised 500 packages, breached hundreds of organizations, stole 300 GB of data, and exfiltrated ~500,000 credentials.
The malware's source code was released on May 11; analysis shows it uses simple tricks like credential theft and string obfuscation rather than advanced exploits, with inconsistent, buggy, and incomplete code.
It works by injecting malicious dependencies or preinstall scripts via OIDC or CI pipelines, stealing credentials (AWS, SSH, GitHub tokens, etc.), and exfiltrating data through encrypted channels or compromised GitHub repos.

A detailed investigation reveals a widespread scam on GitHub where thousands of repositories offer fake game mods, cracks, and software that install the Redox stealer malware.
The malware collects victims' data including crypto wallet keys, bank accounts, social media credentials, Steam and Riot Games accounts, and sends it to a Discord server via webhook.
The scam is promoted through a step-by-step guide on a social engineering forum, which advises creating multiple GitHub accounts, using specific topics to appear in search results, and uploading malicious archives.

FBI issued a FLASH alert about the TeamPCP criminal group on July 2, 2026, detailing its large-scale software supply chain attacks targeting developer and security tools to steal credentials.
TeamPCP compromised tools including Trivy, KICS, LiteLLM, and Telnyx Python SDK by injecting malicious code into legitimate packages, which were then distributed through normal channels and pulled into CI/CD pipelines.
The group deployed four malware families: CanisterWorm, SANDCLOCK, Mini Shai-Hulud, and Miasma, harvesting cloud tokens, API keys, Kubernetes secrets, and cryptocurrency data, with worms spreading autonomously across npm and PyPI registries.

A supply chain attack on RubyGems was discovered via a new gem called git_credential_manager that downloaded malicious binaries from a Forgejo instance.
The gem evolved over four versions in nine hours, starting as a dropper, then silencing output, and finally executing on library load rather than explicit command.
The malware avoids CI environments by checking for over 30 environment variables, targeting developer laptops.

PolinRider is a DPRK-linked supply-chain campaign that takes over legitimate GitHub accounts and injects obfuscated JavaScript loaders into repositories.
Initially confined to GitHub, the campaign expanded to multiple package ecosystems including Packagist, Go modules, npm, and PyPI without evolving its malware.
Ecosystems like Go and Packagist are particularly vulnerable because they resolve packages directly from Git repos, making GitHub account takeovers equivalent to publishing access.

Shai-Hulud is an npm supply-chain malware by TeamPCP, named after the sandworms from Dune, which compromised 500 packages, breached hundreds of organizations, stole 300 GB of data, and exfiltrated ~500,000 credentials.
The malware's source code was released on May 11; analysis shows it uses simple tricks like credential theft and string obfuscation rather than advanced exploits, with inconsistent, buggy, and incomplete code.
It works by injecting malicious dependencies or preinstall scripts via OIDC or CI pipelines, stealing credentials (AWS, SSH, GitHub tokens, etc.), and exfiltrating data through encrypted channels or compromised GitHub repos.

A detailed investigation reveals a widespread scam on GitHub where thousands of repositories offer fake game mods, cracks, and software that install the Redox stealer malware.
The malware collects victims' data including crypto wallet keys, bank accounts, social media credentials, Steam and Riot Games accounts, and sends it to a Discord server via webhook.
The scam is promoted through a step-by-step guide on a social engineering forum, which advises creating multiple GitHub accounts, using specific topics to appear in search results, and uploading malicious archives.

FBI issued a FLASH alert about the TeamPCP criminal group on July 2, 2026, detailing its large-scale software supply chain attacks targeting developer and security tools to steal credentials.
TeamPCP compromised tools including Trivy, KICS, LiteLLM, and Telnyx Python SDK by injecting malicious code into legitimate packages, which were then distributed through normal channels and pulled into CI/CD pipelines.
The group deployed four malware families: CanisterWorm, SANDCLOCK, Mini Shai-Hulud, and Miasma, harvesting cloud tokens, API keys, Kubernetes secrets, and cryptocurrency data, with worms spreading autonomously across npm and PyPI registries.

A supply chain attack on RubyGems was discovered via a new gem called git_credential_manager that downloaded malicious binaries from a Forgejo instance.
The gem evolved over four versions in nine hours, starting as a dropper, then silencing output, and finally executing on library load rather than explicit command.
The malware avoids CI environments by checking for over 30 environment variables, targeting developer laptops.

Hasty Briefsbeta