The Hacker News32%
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks 2%
By Swati Khandelwal21%
8/4/2026, 6:30:00 AM
BS Summary: This article contains 23 faulty reasoning types, including Overconfidence Bias, Availability Heuristic, and Appeal to Authority, with Recency Bias as the most egregious example at 8.9% saturation with 100 hits. Analysis detected 1,149 faulty-reasoning hits from 1,125 analyzed words, generating a BS Score of 4.5% and a BS Rank of 2% (28,480 of 28,846 articles). This article is better (less manipulative) than 98.70% of the article peer group.
A credential-stealing npm worm that first appeared in `keyv@6.0.0` spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.
SafeDep verified 353 poisoned versions across 79 package names in the npm registry.
Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages across 1,381 versions.
Neither broader total was independently reproducible from a complete public list at the reporting cutoff.
The malicious release used a `preinstall` script to run a credential-stealing bundle inside developer and continuous integration (CI) environments.
SafeDep and Socket say it can harvest repository, package registry, cloud and private-key material, then use available npm publishing access to poison more packages.
The Keyv repository also retained separate Claude Code and Visual Studio Code (VS Code) hooks that can execute the payload once a user trusts the workspace or permits the project configuration.
Socket says any workstation or runner that executed an affected version should be treated as credential-exposed.
SafeDep advises responders to remove the malware's credential-revocation watcher before rotating exposed tokens and keys.
Revocation is the watcher's trigger; rotating first can run an attacker-supplied local handler. `npm 12` blocks unapproved dependency lifecycle scripts by default, but earlier npm clients and other install paths that permit lifecycle scripts remain exposed.
The first confirmed malicious release was `keyv@6.0.0`.
It added `node setup.mjs` as a `preinstall` command and included `setup.mjs` and `Math_Symbol.js` in the package while leaving the compiled library code unchanged.
Stage one checks for Bun, downloads version 1.3.13 from the runtime's official GitHub releases if needed, and hands off to a 727,680-byte compiled bundle.
SafeDep's payload analysis says the bundle harvests GitHub, npm, cloud, Vault, Kubernetes, database and private-key material.
It also reads GitHub Actions runner memory, installs a token-revocation watcher and carries npm publishing machinery.
Socket separately decoded code for modifying, versioning and republishing packages available to a stolen npm identity.
The registry changed too quickly to support a fixed campaign-wide list of packages still tagged `latest`.
At 5:40 p.m.
India Standard Time (IST) on August 4, npm package pages showed earlier releases restored as `latest` for at least nine packages from SafeDep's initial set, including `keyv@5.6.0`, `flat-cache@6.1.23`, and `cache-manager@7.2.9`.
The full campaign could not be independently mapped package by package, so exposure checks must use exact package names, resolved versions and lockfiles rather than a cached list of current tags.
The totals reported by SafeDep and Aikido count malicious package artifacts, not victim systems.
They establish campaign scale but do not show how many machines installed or executed the payload.
Determining system-level exposure requires the exact dependency version resolved on the machine and whether its lifecycle script ran.
With tags changing, some related packages remaining clean and the full set incomplete, a namespace-level blocklist risks both missing poisoned versions and treating unaffected releases as compromised.
The repository carries a second execution path.
Its `.claude/settings.json` contains a `SessionStart` hook that calls `.vscode/setup.mjs`.
The `.vscode/tasks.json` file contains an `Environment Setup` task with `runOn: folderOpen` that calls `.claude/setup.mjs`.
Those files create a route for executing the payload from a checked-out repository, but they do not run unconditionally in every default environment.
VS Code blocks automatic tasks in an untrusted workspace and prompts before allowing them by default.
Claude Code applies workspace trust to repository-supplied project settings.
At 5:40 p.m.
IST on August 4, both hook files were still present on `main`.
The `core/keyv/package.json` manifest still declared version `6.0.0`, retained `node setup.mjs` as its `preinstall` command, and listed `setup.mjs` and `Math_Symbol.js` for publication.
The poisoned Keyv release carried valid OpenID Connect (OIDC) and Supply-chain Levels for Software Artifacts (SLSA) provenance because it passed through the project's legitimate GitHub Actions release workflow.
The attestation correctly identified the build process, but could not establish that the source entering it was safe.
SafeDep found the same payload under direct npm publishing accounts elsewhere in the campaign.
It said automated propagation best fits the timing and whole-namespace publishing bursts, although the initiating function was not recovered.
The evidence does not show whether the worm spread solely from one stolen publishing identity or also involved separately compromised publisher credentials.
The package burst therefore cannot establish how many accounts were compromised.
The commit that planted the Claude Code and VS Code hooks carried a green GitHub-verified badge and named `github-actions[bot]` as its author.
The verified badge establishes that the commit's signature was valid, while SafeDep said its author field was set to `github-actions[bot]`; neither fact identifies who controlled the credential that submitted it.
Together, the provenance and commit records verified the build and signing paths, but not whether the source was safe or who controlled the credential.
Not every package linked to the original maintainer was poisoned.
SafeDep says the published `@keyv/*` adapters and the Keyv 5.x line were clean.
The repository is a separate risk: a later commit staged the payload files across all 19 workspace packages, so a release cut from the still-poisoned tree would carry them.
Semgrep documented the same Claude Code and VS Code hooks, `setup.mjs` filename and Bun 1.3.13 download in an April compromise of the `lightning` PyPI package.
Aikido places the August activity in the Shai-Hulud family.
The overlap supports a malware-family connection.
It does not establish who operated the August activity; neither the initial access path nor a named actor is known.
No public incident statement from the maintainer, npm or GitHub was located at the reporting cutoff.
**Update - August 4, 2026:** SafeDep has expanded its registry-backed count to 1,684 poisoned versions across 420 package names tied to nine organizations, replacing the earlier snapshot cited above.
The firm said the worm moved between organizations every two to seven minutes and completed the cross-organization publishing burst in roughly half an hour.
Aikido's separate count remains higher by package name but lower by version, so the two figures should not be combined.
SafeDep said the poisoned Keyv and Cacheable releases have since been unpublished, but `latest` still resolved to a malicious version for most other affected package names at the time of its update.
Upgrading alone may therefore preserve the exposure.
Teams should compare lockfiles and resolved versions against the affected-package list, disable unnecessary install scripts, and treat environments that executed an affected release as compromised.
The researchers also counted 546 public GitHub repositories created on August 4 with the description `Shai-Hulud: Here We Go Again` and a `results/` directory.
These repositories are potential exfiltration or staging artifacts, not 546 confirmed victims.
In a fresh check, the Keyv repository still contained the `.claude` and `.vscode` directories on `main`, including the files associated with the separate Claude Code and VS Code execution path described above.
Speakers
3speakers18%attributed speech917writer words
Selected voice
100%flagged-word coverageSocket
32 attributed words15% of attributed speech54% writer coverage
Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.
Loading…
Loading…
Loading…
Loading…
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.