Keyv and friends compromised in active Shai-Hulud supply chain attack

On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv , a key-value storage library with roughly 127 million weekly npm downloads, and used that access to inject credential-stealing malware across the entire package family. The same maintainer owns cacheable (29M downloads/month), flat-cache (565M downloads/month), file-entry-cache (557M downloads/month), and several other widely-used caching utilities, all of which were swept up in the same attack. The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions.

The compromised packages include:

keyv 6.0.0 (604M/month)

6.0.0 (604M/month) flat-cache 6.1.24 (580M/month)

6.1.24 (580M/month) file-entry-cache 11.1.6 (571M/month)

11.1.6 (571M/month) cacheable-request 13.0.20 (137M/month)

13.0.20 (137M/month) cacheable 2.5.1 (30M/month)

2.5.1 (30M/month) @cacheable/memory 2.2.1 (28M/month)

2.2.1 (28M/month) cache-manager 7.2.10 (16M/month)

7.2.10 (16M/month) @cacheable/node-cache 3.1.2 (6M/month)

... continue reading