What Happened
At 09:35 UTC on August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv, a key-value storage library with approximately 127 million weekly npm downloads. That account also owns several other heavily used packages: cacheable (29 million weekly downloads), flat-cache (565 million weekly downloads), file-entry-cache (557 million weekly downloads), and the broader @cacheable scoped namespace. All were swept into the same compromise within minutes.
The attackers pushed malicious commits to each repository’s main branch and immediately cut new releases. Each poisoned version carries valid OIDC and SLSA provenance signatures generated by GitHub Actions — the same pipeline the maintainer uses for legitimate releases — making the malicious packages appear authentic to supply chain auditing tools. SafeDep verified 442 poisoned versions across 353 package names; Aikido Security later reported at least 868 packages across 1,381 versions with a combined 2 billion-plus monthly installs.
The worm spread from the initial compromise to nine unrelated organizations, reaching each in two to seven minutes, in under 30 minutes total. Affected organizations include delivery, automotive, software services, and enterprise technology companies.
The payload, a descendant of the Mini Shai-Hulud credential stealer, fires via a preinstall hook that downloads the Bun runtime and executes a 728 KB obfuscated bundle. It harvests .npmrc authentication tokens, GitHub CLI tokens, AWS credentials, HashiCorp Vault tokens, Kubernetes configs, and cryptocurrency wallet files. The attackers also modified VS Code and Claude Code repository configuration files in the compromised repositories so that a developer who simply opens a cloned repository in either IDE triggers malicious code execution — no npm install required.
Why This Matters for Canadian Organizations
Canadian development teams, startups, digital government services, and financial technology firms depend heavily on the Node.js and npm ecosystem. The keyv, flat-cache, and file-entry-cache packages appear in millions of downstream dependencies, including popular web frameworks, build tooling, and CI/CD pipelines. A developer or automated pipeline that installs a poisoned version does not need to have noticed anything unusual — the preinstall hook runs silently before any code executes.
The IDE hook component is particularly concerning. Security teams are trained to treat npm install with caution, but opening a repository in VS Code or Claude Code is treated as a safe, passive action. The worm exploits that assumption, creating a realistic path to credential theft for any developer who clones a repository containing a poisoned dependency lock file, even in an air-gapped review environment. Many Canadian government digital service teams, banks, and insurance companies use Claude Code or VS Code as standard developer tooling.
Under OSFI Guideline B-13, federally regulated financial institutions are required to manage third-party technology risk, including software supply chain dependencies. Any organization that ran npm install between approximately 09:35 UTC and 12:00 UTC on August 4 and pulled a package from the keyv or @cacheable family should treat its build and CI/CD environment as potentially compromised. PIPEDA breach notification obligations are triggered if personal data accessible from the compromised environment was exposed.
What to Do
Audit your package-lock.json and yarn.lock files for keyv, cacheable, flat-cache, file-entry-cache, cache-manager, cacheable-request, or any @cacheable scoped package installed between August 4 09:35 UTC and the time clean versions were restored. Do not run npm install in any affected repository until you have verified the dependency tree. Rotate all credentials accessible from CI/CD environments, including AWS access keys, GitHub tokens, .npmrc tokens, Kubernetes service account tokens, and any Vault credentials. Inspect VS Code and Claude Code workspace configuration files for unexpected entries. If your organization runs a CI/CD pipeline that pulled any affected version, treat the pipeline runner as compromised and rotate all secrets it holds access to.
Review your internal software composition analysis tooling to determine whether its provenance verification controls would have caught a malicious package with valid SLSA and OIDC signatures — this incident demonstrates that provenance alone is insufficient when a maintainer account is compromised.
Source: The Hacker News | SafeDep | Aikido Security
