Audit log

Every state-changing event for keyv / cacheable npm Supply Chain Attack — TeamPCP Mini Shai-Hulud (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-08 12:06:52Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   7zFr31Deo6Ct…iFFVJ3XNcopysha256 → base58

   verifying row…

   canonical bytes (32921 B) ▸

   {"actor":"system:backfill","investigation_id":"49f04edf-4c80-4118-a494-f18aa91ae323","kind":"publish","page_slug":"keyv-cacheable-npm-supply-chain-attack-teampcp-mini-shai-hulud-august-2026","published_at":"2026-08-08T12:06:52.834Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"keyv / cacheable npm Supply Chain Attack — TeamPCP Mini Shai-Hulud (August 2026)","sections":[{"content":"On August 4, 2026, attackers compromised the GitHub account of Jared Wray (username: jaredwray), the primary maintainer of keyv and the cacheable package family on npm. Beginning at approximately 09:02 UTC, malicious commits were pushed directly to the main branch of the keyv repository. Malicious versions were published to the npm registry starting at approximately 09:35 UTC. Within roughly 40 minutes, nine additional packages under the same maintainer account were trojanized. A self-propagating worm mechanism then used stolen npm tokens from victim environments to republish infected versions of hundreds of additional packages accessible to those tokens, with the full automated propagation burst completing in approximately 30 minutes. By August 5, the attack had affected an estimated 444 distinct npm package names across 2,234 poisoned versions, with a combined downstream exposure exceeding two billion monthly installs.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign — Chainguard","type":"research","url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign"},{"credibility":2,"name":"Worm compromises hundreds of popular npm packages — Datadog Security Labs","type":"research","url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/"},{"credibility":2,"name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack — Socket","type":"research","url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain"},{"credibility":2,"name":"Keyv npm Package with 127M Weekly Downloads Compromised in Shai-Hulud Attack — CybersecurityNews","type":"news_article","url":"https://cybersecuritynews.com/keyv-npm-package-compromised/"}]},{"content":"The initial access vector was the compromise of the GitHub account for the keyv maintainer (jaredwray). Multiple security researchers confirmed the attacker used this compromised identity to push commits directly to the keyv repository, then triggered GitHub Actions workflows that published signed npm releases with valid SLSA provenance attestations. This is significant because the poisoned packages appeared legitimate from a provenance standpoint: they were signed by GitHub Actions and carried valid Sigstore attestations generated from already-trojanized source code. The specific mechanism of account compromise — whether through phishing, credential stuffing, or session token theft — had not been publicly confirmed by npm, GitHub, or the maintainer at the time of reporting across the sources reviewed. Some sources, including the initial request context, allege a phishing email using a fake npm support domain (npmjs.help) was used to steal 2FA credentials; however, this specific claim was not independently verified in the primary security research publications reviewed for this investigation and should be treated as alleged pending official confirmation.","heading":"Initial Access and Account Compromise","severity":"critical","sources":[{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise — Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"credibility":2,"name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack — Orca Security","type":"research","url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/"},{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack — Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"}]},{"content":"The following 11 packages were directly compromised as primary targets (malicious versions listed):\n\n- keyv@6.0.0 (~604 million monthly downloads)\n- flat-cache@6.1.24 (~580 million monthly downloads)\n- file-entry-cache@11.1.6 (~571 million monthly downloads)\n- cacheable-request@13.0.20 (~137 million monthly downloads)\n- cacheable@2.5.1 (~30 million monthly downloads)\n- @cacheable/memory@2.2.1 (~28 million monthly downloads)\n- @cacheable/utils@2.5.1 (~34 million monthly downloads)\n- cache-manager@7.2.10 (~16 million monthly downloads)\n- @cacheable/node-cache@3.1.2 (~6 million monthly downloads)\n- @cacheable/net@2.1.1 (~3,700 monthly downloads)\n- ecto@5.0.1 (~4,500 monthly downloads)\n\nThe worm's self-propagation mechanism expanded the blast radius to over 400 additional package names — with estimates ranging from 420 to 868 depending on source and reporting time — totaling over 2,234 poisoned versions. Combined with worm-propagated packages, the total downstream exposure exceeded two billion monthly installs, making this one of the largest npm supply chain incidents by download volume.","heading":"Affected Packages and Scale","severity":"critical","sources":[{"credibility":2,"name":"Keyv and friends compromised in npm supply chain attack — Aikido Security","type":"research","url":"https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again — JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"keyv and cacheable npm compromise: 400+ packages — SafeDep","type":"research","url":"https://safedep.io/keyv-npm-supply-chain-compromise/"}]},{"content":"The attack deployed a two-stage malware payload identified by security researchers as the 'Mini' Shai-Hulud family, consistent with prior TeamPCP campaigns.\n\nStage 1 — setup.mjs (approximately 11–30 KB dropper): Added to each compromised package's preinstall lifecycle hook via 'preinstall': 'node setup.mjs' in package.json. This script detects or downloads the Bun JavaScript runtime (version 1.3.13) from official GitHub releases without cryptographic verification, then executes Stage 2 under Bun to potentially bypass Node.js-specific monitoring controls.\n\nStage 2 — Math_Symbol.js / math_init.js (approximately 710–728 KB obfuscated payload): A heavily obfuscated Bun bundle using Base91 encoding and permuted alphabets. Its capabilities include: credential harvesting across 290 Linux, 129 macOS, and 50 Windows file path patterns; encrypted exfiltration using AES-256-GCM with RSA-OAEP wrapped keys; npm worm propagation using stolen tokens; and GitHub repository infection via persistence hooks.\n\nThe payload targeted an unusually broad set of credential types: npm tokens (.npmrc files); GitHub tokens (classic PATs, OAuth tokens, GitHub Apps, OIDC tokens, Actions runner memory on Linux with sudo access); AWS credentials (profiles, environment variables, instance metadata service, Secrets Manager); GCP service accounts; Azure secrets; HashiCorp Vault tokens (VAULT_TOKEN environment variable); Kubernetes service account tokens and API queries; SSH keys and private key blocks; Terraform state files; Docker configs; Stripe and Slack API keys; and cryptocurrency wallet credentials and seed phrases. A single-instance lock (tmp.dpkg_14527.lock) prevents redundant execution.\n\nA secondary persistence mechanism injected execution hooks into accessible GitHub repositories via two files: .claude/settings.json (registering a SessionStart command targeting Claude Code users) and .vscode/tasks.json (using runOn: 'folderOpen' to execute on project open in VS Code). These hooks create additional execution paths for developers who later clone or open infected repositories.\n\nFile hashes for key payload components:\n- Math_Symbol.js / math_init.js SHA-256: 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc\n- setup.mjs (one variant) SHA-256: 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668","heading":"Malware: Mini Shai-Hulud Payload Architecture","severity":"critical","sources":[{"credibility":2,"name":"Worm compromises hundreds of popular npm packages — Datadog Security Labs","type":"research","url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again — JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise — Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack — Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"}]},{"content":"The Mini Shai-Hulud payload employs a layered C2 architecture designed to resist infrastructure takedowns.\n\nPrimary C2 resolution: The payload queries the Ethereum mainnet smart contract at address 0xE1f2395ee43e45A1556EC6438a88c31B83493103 (selector: 0x53ed5143) via a pool of 73 public Ethereum RPC endpoints including eth-mainnet.nodereal.io, go.getblock.io, and eth.llamarpc.com. This allows the attacker to rotate the active exfiltration domain at any time without modifying the payload or any attacker-controlled server.\n\nKnown C2 domains (resolved via the smart contract or hardcoded fallbacks):\n- awqhnjewqjkl[.]icu:443/router\n- pypi-get[.]com:443/router\n- js-mirror[.]com:443/router\n- npm-cache[.]com:443/router (registered 2026-05-22)\n\nFallback dead-drop: The payload searches GitHub repositories for descriptions containing the marker string 'thebeautifulmarchoftime' (with variant 'thebeautifulsnadsoftime') to retrieve signed domain information when primary C2 fails. Approximately 1,300 GitHub repositories carrying this marker were identified at peak.\n\nData staging: Exfiltrated credentials were encrypted and staged to attacker-created GitHub repositories before transmission to C2 endpoints.\n\nDead-man switch: The payload installs a host-level monitor that polls the GitHub API every 60 seconds and evaluates remotely supplied commands upon token revocation, providing post-compromise persistence and remote control.","heading":"Command and Control Infrastructure","severity":"critical","sources":[{"credibility":2,"name":"Worm compromises hundreds of popular npm packages — Datadog Security Labs","type":"research","url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again — JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised — Socket","type":"research","url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain"}]},{"content":"A key distinguishing feature of the Mini Shai-Hulud campaign is its automated self-propagation capability. After harvesting npm tokens from a victim's environment, the payload executes the following sequence in real-time:\n\n1. Validates stolen npm tokens against the registry to confirm write access.\n2. Enumerates all packages the compromised token has permission to publish.\n3. Downloads the current tarballs of those packages.\n4. Injects the identical preinstall hook and payload files into each tarball.\n5. Increments the version number.\n6. Republishes the trojanized package directly to the npm registry.\n\nFor GitHub tokens, the worm commits the .claude/settings.json and .vscode/tasks.json persistence hooks to accessible branches of repositories. Notably, the worm also attempted to generate fresh Sigstore SLSA provenance attestations for republished packages via a narrow gate targeting the opensearch-js repository's trusted publishing configuration, allowing some propagated packages to carry valid provenance attestations despite being trojanized.\n\nThe cross-organization publishing burst completed in approximately 30 minutes from initial compromise. The malware moved between organizations every two to seven minutes during propagation. This speed, combined with the provenance bypass, made automated detection and blocking exceptionally difficult during the active window.","heading":"Worm Self-Propagation Mechanism","severity":"critical","sources":[{"credibility":2,"name":"Keyv and friends compromised in npm supply chain attack — Aikido Security","type":"research","url":"https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack"},{"credibility":2,"name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised — Socket","type":"research","url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain"},{"credibility":2,"name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack — Orca Security","type":"research","url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/"}]},{"content":"Multiple security vendors — including Wiz, Chainguard, JFrog, and Orca Security — attribute this campaign to the TeamPCP threat group, also tracked under aliases including UNC6780, PCPcat, ShellForce, CipherForce, and DeadCatx3. TeamPCP is described as a financially motivated, cloud-native cybercrime group first observed in November 2025.\n\nTeamPCP has a documented history of software supply chain attacks spanning npm, PyPI, GitHub Actions, Docker registries, and IDE marketplaces. Prior major campaigns attributed to the group include: the March 2026 compromise of Aqua Security's Trivy GitHub Action and Checkmarx KICS (deploying the SANDCLOCK credential stealer, a designation used by Google GTIG); the March 2026 LiteLLM PyPI trojanization affecting approximately 1,705 dependent packages; the May 2026 TanStack npm compromise (84 malicious versions across 42 packages via OIDC token theft); and the May 2026 AntV ecosystem attack (324 packages republished in automated bursts). On April 2–3, 2026, CERT-EU officially attributed the breach of the European Commission's AWS environment to TeamPCP.\n\nThe August 2026 keyv attack is assessed as the seventh major operational phase of TeamPCP, representing a significant escalation in scale. The group open-sourced the Shai-Hulud worm toolkit on May 12, 2026, which may have enabled derived operators. The self-identification string 'Shai-Hulud: Here We Go Again' appears in GitHub repository descriptions used as C2 dead drops, consistent with prior campaign signatures.","heading":"Attribution: TeamPCP Threat Group","severity":"high","sources":[{"credibility":2,"name":"TeamPCP — The supply chain attack story so far — Pluto Security","type":"research","url":"https://teampcp.pluto.security/"},{"credibility":2,"name":"Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure — Palo Alto Unit 42","type":"research","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack — Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"},{"credibility":2,"name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign — Chainguard","type":"research","url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign"}]},{"content":"Socket's automated scanner flagged the malicious code approximately 5 minutes and 18 seconds after keyv@6.0.0 was published to the npm registry. Community members began posting warnings about unexpected hooks in the keyv repository within the first 10 minutes of the attack window.\n\nBy approximately 10:18–10:20 UTC (roughly 45 minutes after the first malicious package was published), public warnings had spread across security channels. npm began removing compromised versions and began restoring prior safe versions by approximately 10:39 UTC on August 4. The maintainer's previous clean versions were restored as the 'latest' tag for at least nine affected packages by approximately 5:40 PM IST on August 4.\n\nSafe versions to pin to (all versions prior to the malicious releases):\n- keyv: use versions prior to 6.0.0 (e.g., 5.6.0)\n- flat-cache: use versions prior to 6.1.24 (e.g., 6.1.23)\n- cache-manager: use versions prior to 7.2.10 (e.g., 7.2.9)\n- cacheable-request: use versions prior to 13.0.20 (e.g., 13.0.19)\n\nA notable mitigation: npm 12 and later versions do not execute preinstall lifecycle hooks by default, which would have blocked the payload execution for users on that version.","heading":"Community Detection and Response","severity":"high","sources":[{"credibility":2,"name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised — Socket","type":"research","url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain"},{"credibility":2,"name":"Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html"},{"credibility":2,"name":"keyv and cacheable npm Supply Chain Attack: What to Do — Strobes","type":"research","url":"https://strobes.co/blog/keyv-cacheable-npm-supply-chain-attack/"}]},{"content":"Organizations should audit their environments for the following indicators:\n\nFile artifacts:\n- setup.mjs present in any node_modules package directory (SHA-256: 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668)\n- Math_Symbol.js or math_init.js present in node_modules (SHA-256: 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc)\n- Temporary Bun download artifacts: /tmp/bun-dl-* directories\n- Lock file: /tmp/tmp.dpkg_14527.lock (indicates active or recent execution)\n- .claude/settings.json with a SessionStart hook in any project repository\n- .vscode/tasks.json with runOn: 'folderOpen' added by an unexpected commit\n\nNetwork indicators:\n- Outbound connections to npm-cache[.]com, pypi-get[.]com, js-mirror[.]com, awqhnjewqjkl[.]icu\n- Outbound HTTPS to Ethereum JSON-RPC endpoints: eth-mainnet.nodereal.io, go.getblock.io, eth.llamarpc.com\n- User-Agent string: Bun/1.3.13 in outbound HTTP requests\n- Ethereum contract queries to 0xE1f2395ee43e45A1556EC6438a88c31B83493103\n\nGitHub indicators:\n- Repositories with descriptions containing 'thebeautifulmarchoftime' or 'thebeautifulsnadsoftime'\n- Unexpected npm publish events across packages not in normal release cadence","heading":"Indicators of Compromise (IOCs)","severity":"high","sources":[{"credibility":2,"name":"Worm compromises hundreds of popular npm packages — Datadog Security Labs","type":"research","url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again — JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack — Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"}]},{"content":"Any developer or CI/CD system that ran npm install against an affected package version between August 4, 2026 and patch restoration should treat the following credentials as compromised and rotate them immediately:\n\n- All npm tokens (especially those with publish or bypass_2fa permissions)\n- All GitHub personal access tokens, OAuth tokens, and GitHub Apps credentials\n- All AWS access keys and secrets (including instance profile credentials)\n- All GCP service account keys\n- All Azure secrets and credentials\n- All HashiCorp Vault tokens\n- All Kubernetes service account tokens\n- All SSH private keys present on the affected system\n- All cryptocurrency wallet seed phrases and private keys stored on disk or in environment variables\n- All Stripe, Slack, and other API keys present in the environment\n\nAdditional recommended steps:\n1. Pin dependencies to known-clean versions and verify package integrity.\n2. Audit all npm packages published by your team after August 4 for unexpected preinstall hooks or payload files.\n3. Audit GitHub repositories for unexpected commits to .claude/settings.json or .vscode/tasks.json.\n4. Block the identified C2 domains at the network perimeter.\n5. Rebuild affected CI/CD environments from a clean state rather than attempting in-place remediation.\n6. Upgrade to npm 12 or later, which does not execute preinstall hooks by default.","heading":"Remediation Guidance","severity":"critical","sources":[{"credibility":2,"name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack — Orca Security","type":"research","url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/"},{"credibility":2,"name":"keyv and cacheable npm Supply Chain Attack: What to Do — Strobes","type":"research","url":"https://strobes.co/blog/keyv-cacheable-npm-supply-chain-attack/"},{"credibility":2,"name":"Keyv and Cacheable npm Packages Compromised in Active Supply-Chain Attack — Cloudsmith","type":"research","url":"https://cloudsmith.com/blog/keyv-and-cacheable-npm-packages-compromised-in-active-supply-chain-attack"}]},{"content":"Security researchers across multiple organizations highlighted a critical systemic finding: the compromised packages were published with valid SLSA provenance attestations signed by GitHub Actions, because the malicious code was injected into the source repository before the legitimate build pipeline ran. As Chainguard noted: 'Provenance and attestation prove who published a package, not that the publisher's environment was trustworthy.' Socket similarly emphasized: 'provenance attests build integrity, not source integrity.' This finding demonstrates that current provenance signing frameworks do not provide protection against maintainer account compromise combined with source-level injection.\n\nThe attack also highlighted the cascading risk profile created when a single maintainer controls many high-download packages. The keyv maintainer's account had write access to packages collectively representing over two billion monthly downloads, making it a high-value single point of failure. The worm's ability to generate fresh Sigstore provenance for republished packages further undermines automated verification-based defenses.","heading":"Systemic Supply Chain Security Implications","severity":"high","sources":[{"credibility":2,"name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign — Chainguard","type":"research","url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign"},{"credibility":2,"name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised — Socket","type":"research","url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain"}]}],"sources_used":[{"credibility":2,"name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign — Chainguard","type":"research","url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign"},{"credibility":2,"name":"Keyv and friends compromised in npm supply chain attack — Aikido Security","type":"research","url":"https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack"},{"credibility":2,"name":"Worm compromises hundreds of popular npm packages — Datadog Security Labs","type":"research","url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/"},{"credibility":2,"name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack — Socket","type":"research","url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages — JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise — Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack — Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"},{"credibility":2,"name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack — Orca Security","type":"research","url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/"},{"credibility":2,"name":"keyv and cacheable npm compromise: 400+ packages — SafeDep","type":"research","url":"https://safedep.io/keyv-npm-supply-chain-compromise/"},{"credibility":2,"name":"Keyv and Cacheable npm Packages Compromised in Active Supply-Chain Attack — Cloudsmith","type":"research","url":"https://cloudsmith.com/blog/keyv-and-cacheable-npm-packages-compromised-in-active-supply-chain-attack"},{"credibility":2,"name":"keyv and cacheable npm Supply Chain Attack: What to Do — Strobes","type":"research","url":"https://strobes.co/blog/keyv-cacheable-npm-supply-chain-attack/"},{"credibility":2,"name":"Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html"},{"credibility":2,"name":"Keyv npm Package with 127M Weekly Downloads Compromised in Shai-Hulud Attack — CybersecurityNews","type":"news_article","url":"https://cybersecuritynews.com/keyv-npm-package-compromised/"},{"credibility":2,"name":"TeamPCP — The supply chain attack story so far — Pluto Security","type":"research","url":"https://teampcp.pluto.security/"},{"credibility":2,"name":"Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure — Palo Alto Unit 42","type":"research","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"credibility":2,"name":"TanStack npm Packages Hit by Mini Shai-Hulud — Snyk","type":"research","url":"https://snyk.io/blog/tanstack-npm-packages-compromised/"},{"credibility":2,"name":"NPM Malware Compromises keyv and cacheable — Endor Labs","type":"research","url":"https://www.endorlabs.com/learn/npm-malware-compromises-keyv-and-cacheable-with-500m-weekly-downloads-and-spreads-to-hundreds-of-packages"},{"credibility":2,"name":"No Install Required: The keyv and cacheable npm Worm That Weaponized AI Coding Agents — Cycode","type":"research","url":"https://cycode.com/blog/keyv-cacheable-npm-worm-ai-coding-agents/"}],"summary":"On August 4, 2026, the GitHub account of Jared Wray (jaredwray), maintainer of the keyv and cacheable npm package ecosystems, was compromised, enabling attackers to inject the Mini Shai-Hulud credential-stealing worm into at least 11 core packages representing over two billion combined monthly downloads. A self-propagating worm mechanism subsequently expanded the blast radius to more than 400 additional npm packages across 2,234 poisoned versions. The attack is attributed to the TeamPCP threat group and represents one of the largest npm supply chain compromises on record by download volume.","timeline":[{"date":"2025-11-01","event":"TeamPCP threat group first observed conducting cloud-native cryptomining and credential theft campaigns.","source":"Pluto Security — TeamPCP: The supply chain attack story so far","source_url":"https://teampcp.pluto.security/"},{"date":"2026-03-19","event":"TeamPCP Phase 2/3: 76 of 77 Trivy GitHub Action tags force-pushed with SANDCLOCK credential stealer; CanisterWorm infected 66+ npm packages using ICP blockchain for C2.","source":"Palo Alto Unit 42 — Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack","source_url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"date":"2026-04-02","event":"CERT-EU officially attributed the breach of the European Commission's AWS environment to TeamPCP.","source":"Pluto Security — TeamPCP: The supply chain attack story so far","source_url":"https://teampcp.pluto.security/"},{"date":"2026-05-11","event":"TeamPCP Phase 5: TanStack attack — 84 malicious versions published across 42 @tanstack/* npm packages via OIDC token theft.","source":"Snyk — TanStack npm Packages Hit by Mini Shai-Hulud","source_url":"https://snyk.io/blog/tanstack-npm-packages-compromised/"},{"date":"2026-05-12","event":"TeamPCP open-sourced the Shai-Hulud worm toolkit under the description 'A Gift From TeamPCP', enabling potential derived operators.","source":"Pluto Security — TeamPCP: The supply chain attack story so far","source_url":"https://teampcp.pluto.security/"},{"date":"2026-08-04","event":"09:02 UTC: First malicious commit pushed to keyv GitHub repository by attacker using compromised jaredwray account credentials.","source":"Datadog Security Labs — Worm compromises hundreds of popular npm packages","source_url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/"},{"date":"2026-08-04","event":"09:04 UTC: GitHub Actions bot commits add .claude/settings.json and .vscode/tasks.json IDE persistence hooks to repository branches.","source":"Datadog Security Labs — Worm compromises hundreds of popular npm packages","source_url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/"},{"date":"2026-08-04","event":"09:35 UTC: Malicious keyv@6.0.0 published to npm registry with valid SLSA provenance attestation.","source":"Snyk — Inside the keyv npm Supply Chain Compromise","source_url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"date":"2026-08-04","event":"09:40 UTC (approx.): Socket's automated scanner flags malicious code in keyv@6.0.0 approximately 5 minutes 18 seconds after publication.","source":"Socket — Popular npm Packages in the keyv and Cacheable Namespaces Compromised","source_url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain"},{"date":"2026-08-04","event":"10:06–10:28 UTC: Nine additional compromised Cacheable-family packages and ecto@5.0.1 published in rapid succession.","source":"Datadog Security Labs — Worm compromises hundreds of popular npm packages","source_url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/"},{"date":"2026-08-04","event":"10:18–10:20 UTC (approx.): Public warnings spread across security channels about the attack.","source":"The Hacker News — Keyv-Linked npm Worm Poisons Hundreds of Packages","source_url":"https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html"},{"date":"2026-08-04","event":"10:39 UTC (approx.): npm begins removing compromised versions; worm propagation burst completes with approximately 2,234 poisoned versions across 444 packages.","source":"The Hacker News — Keyv-Linked npm Worm Poisons Hundreds of Packages","source_url":"https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html"},{"date":"2026-08-04","event":"By 17:40 IST: Previous clean versions restored as 'latest' for at least nine primary affected packages.","source":"The Hacker News — Keyv-Linked npm Worm Poisons Hundreds of Packages","source_url":"https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html"},{"date":"2026-08-05","event":"Security researchers report total impact of 444+ distinct packages and 1,381–2,234 poisoned versions; combined downstream exposure confirmed at over 2 billion monthly installs.","source":"Aikido Security — Keyv and friends compromised in npm supply chain attack","source_url":"https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f8cd030d-ae07-4bcb-9e9f-2a0cd5c122f7copy