Massive npm Worm Infiltrates Keyv Ecosystem and Exploits Claude Code Hooks

DNI SUMMARY — KEY POINTS

• A sophisticated credential-stealing worm has compromised the Keyv and Cacheable npm ecosystems by exploiting a hijacked GitHub maintainer account.
• Security researchers identified over 400 affected packages that utilize malicious payloads to harvest cloud credentials and sensitive developer environment secrets.
• The malware distinguishes itself by embedding persistence hooks within Claude Code and VS Code to ensure long-term access after installation.
• Technical analysis reveals the worm is a variant of the Shai-Hulud family which previously targeted major libraries like Axios and AntV.
• Industry experts strongly advise developers to rotate all exposed API tokens and implement strict lifecycle script controls on their local machines.

A catastrophic supply chain attack has swept through the JavaScript ecosystem, placing millions of development environments at risk by poisoning the popular Keyv and Cacheable npm packages. Commencing on August 4, 2026, the malicious campaign exploited a compromised maintainer identity to push tainted updates that function as a self-replicating worm. Once executed, the code performs a sweeping harvest of sensitive data, including cloud infrastructure secrets, private keys, and environment variables stored within developer machines or continuous integration pipelines. The scale of this breach highlights a deepening vulnerability in modern software distribution channels.

Stealthy Hooks in Development Tools

The technical sophistication of this attack lies in its multi-layered persistence strategy, which extends beyond simple script execution. Upon infection, the malware identifies the presence of Claude Code and VS Code configurations, embedding specialized hooks that guarantee the malicious payload survives system restarts and routine updates. This represents a dangerous evolution in supply chain threats where attackers now target the very AI-assisted development tools that teams increasingly rely on for coding efficiency. Security researchers warn that these hooks turn automated assistants into unwitting vehicles for continued data exfiltration and credential theft.

Investigations into the payload indicate that the Shai-Hulud malware family remains the primary architecture driving these widespread npm compromises. By deploying preinstall scripts that trigger a 727-kilobyte compiled bundle, the attackers effectively bypass traditional signature-based detection methods in many standard security tools. The malware is specifically designed to check for the presence of the Bun runtime, downloading version 1.3.13 if necessary to facilitate its malicious operations. This calculated selection of tools allows the attacker to maintain a low profile while maximizing the efficiency of their credential harvesting processes across diverse machine architectures.

The Anatomy of the Worm

The fallout from the campaign has already triggered widespread concern among enterprise security teams managing large-scale software deployments. Reports from security firms suggest that hundreds of package versions were poisoned within a narrow window, forcing maintainers to scramble for remediation strategies. Because the registry state was altered so rapidly to restore older, clean versions, many organizations struggled to verify if their current dependencies were ever exposed to the threat. This instability serves as a stark reminder of the fragile trust model that currently underpins the global npm registry and the urgent need for more robust integrity verification protocols.

In addition to stealing secrets, the attackers implemented a defensive mechanism intended to sabotage recovery efforts by triggering a local handler upon credential revocation. This 'dead man's switch' threatens to disrupt live production servers if the compromised API keys are invalidated, creating a significant dilemma for security responders attempting to purge the infection. The audacity of this extortion tactic demonstrates a level of maturity rarely seen in automated supply chain attacks, forcing companies to carefully balance the need for security remediation against the immediate operational stability of their production environments.

Strategic Risks to Production Systems

The connection between the current Keyv incident and previous campaigns involving Axios and AntV points to a persistent threat actor or coordinated syndicate operating at scale. These campaigns share similar hallmarks, including the use of npm tokens to automate the propagation of malicious code to unrelated projects. As investigators continue to analyze the exfiltration infrastructure, they have uncovered numerous GitHub repositories used as dead-drops for stolen data, often labeled with taunting references to the malware's lineage. This pattern suggests that the attackers are not merely opportunistic, but are systematically building a vast database of stolen enterprise secrets.

Mitigation remains the primary focus for developers who may have installed affected versions of these libraries during the window of exposure. Experts advise that any workstation or build runner that executed these versions should be treated as fundamentally compromised, necessitating a full rotation of all stored secrets, tokens, and database credentials. While newer versions of the npm client have improved security by blocking unapproved lifecycle scripts by default, legacy environments and specific installation paths remain susceptible. Organizations must adopt proactive measures such as dependency pinning and rigorous audit processes to insulate their workflows from these escalating automated attacks.

Forging a More Secure Future

The broader implications for the open-source community are profound, signaling a turning point in how software supply chains must be defended against increasingly professionalized adversaries. As generative AI becomes a standard component of the developer stack, the potential for poisoned plugins and model-integrated code to facilitate attacks will only grow. Industry leaders are now calling for a fundamental shift toward cryptographic signing of all package releases and more aggressive monitoring of CI/CD pipelines. Securing the future of software development will require a collaborative effort that bridges the gap between individual package maintainers and the global enterprise entities that rely on their work.

sectionHeadings

Stealthy Hooks in Development Tools

The Anatomy of the Worm

Strategic Risks to Production Systems

Forging a More Secure Future