Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Shai-Hulud credential-stealing npm worm spreading through poisoned package releases

Malware Activity
First reported
Last updated
Happening score
H score 38
2 unique sources, 2 articles

Summary

Hide ▲

A Shai-Hulud-based npm supply-chain malware activity spread through poisoned package releases beginning on August 4, 2026, after a maintainer’s GitHub account for keyv was compromised. The worm used credential-stealing releases to move beyond the original namespace into hundreds of packages, with researchers identifying more than 430 npm packages and two billion monthly installs in the broader ChainDrop campaign. The payload targets GitHub and npm tokens, AWS credentials, Kubernetes secrets, HashiCorp Vault tokens, and Stripe and Slack tokens, then exfiltrates them to a public GitHub repository. Packages associated with Deliveroo, Ornikar, OneReach, Picsart, and Qlik were also reported as compromised.

Related Happenings

AsyncAPI malicious npm package supply-chain malware

Malware Activity
H score21 First: 15.07.2026 18:37 Last: 15.07.2026 18:37 Sources 1

About this happening: Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...

Open Happening

Rollup polyfill npm package malware activity for remote access and data theft

Malware Activity
H score16 First: 03.07.2026 19:07 Last: 03.07.2026 19:07 Sources 1

About this happening: Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...

Open Happening

Shai-Hulud PyPI supply-chain malware activity

Malware Activity
H score22 First: 08.06.2026 23:41 Last: 08.06.2026 23:41 Sources 1

About this happening: The Shai-Hulud supply-chain malware compromised 19 PyPI packages, turning routine installs into secret-stealing execution and putting developer credentials at risk. Th...

Open Happening

IronWorm npm supply-chain infection and self-propagation

Malware Activity
H score15 First: 04.06.2026 18:25 Last: 04.06.2026 18:25 Sources 1

About this happening: IronWorm is a Rust infostealer in a npm supply-chain activity that hides behind an eBPF kernel rootkit, communicates over Tor, and targets 86 environment var...

Open Happening

Miasma GitHub and npm supply-chain campaign

Campaign
H score26 First: 02.06.2026 00:38 Last: 02.06.2026 00:38 Sources 1

About this happening: Miasma is a supply-chain campaign that began in Red Hat's @redhat-cloud-services npm namespace and later expanded across npm, PyPI, the Go ecosystem, and Git...

Latest development: 05.06.2026 21:05

A new Miasma wave is linked to 57 compromised npm packages across more than 286 malicious versions, with malicious installs abusing a 157-byte binding.gyp file for code execution during npm install and then staging additional payloads that inject persistent backdoor files into project repositories and target AI-assisted IDE workflows.

Open Happening

Timeline

  1. 05.08.2026 13:00 1 articles · 2d ago

    ChainDrop compromises more than 430 npm packages with two billion installs

    Victim Impact Update

    Security researchers say the ChainDrop Shai-Hulud-based campaign has already compromised more than 430 npm packages with a combined two billion monthly installs, including packages associated with Deliveroo, Ornikar, OneReach, Picsart, and Qlik.

    Show sources
    Open in new tab
  2. 04.08.2026 16:30 2 articles · 3d ago

    [email protected] launches a credential-stealing npm worm across the registry

    Initial Disclosure

    The first confirmed malicious release, [email protected], spread a credential-stealing npm worm beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.

    Show sources
    Open in new tab
  3. 04.08.2026 16:30 1 articles · 3d ago

    Aikido places the npm worm in the Shai-Hulud family

    Attribution Update

    SafeDep and Socket describe a malicious preinstall bundle that runs in developer and CI environments, harvests GitHub, npm, cloud, Vault, Kubernetes, database, and private-key material, and can use stolen npm access to poison more packages; the repository also retained Claude Code and VS Code hook paths, and Aikido places the August activity in the Shai-Hulud family while the initial access path and named operator remain unknown.

    Show sources
    Open in new tab