Shai-Hulud worm hits keyv and cache packages on npm: check and rotate keys
In August 2026, over 1,300 npm package versions, including keyv, were poisoned by a worm that steals developer credentials.
Affects:keyv, cacheable, flat-cache on npmOver 1,300 npm package versionsDeveloper machines and CI/CD
In August 2026, a new wave of the Shai-Hulud worm hit npm, the registry where JavaScript projects get their building blocks. Attackers used a compromised GitHub maintainer account behind keyv, a widely used storage library, to publish malicious versions. Singapore's Cyber Security Agency (CSA) reported on August 6, 2026 that over 1,300 package versions were compromised, with a combined 2 billion monthly downloads, including popular caching libraries.
The malware steals developer credentials and uses them to infect more packages, which is why it spreads like a worm. This is the same malware family that the US agency CISA warned about in September 2025.
Who is affected
Any project that installed an affected version, directly or as a dependency of another package, and the laptops and build servers (CI/CD) where the install ran. Examples listed by CSA include keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable 2.5.1 and cache-manager 7.2.10. Many projects built with Node.js, Next.js or React depend on such packages indirectly, often through development tools. The live site is not necessarily infected, but the keys used to build and deploy it may be stolen.
How to check your site
Ask your developer to compare the project's lock file (package-lock.json, yarn.lock or pnpm-lock.yaml) and build logs from early August 2026 with the published list of affected versions. Also check your GitHub account for repositories you did not create whose description contains "Shai-Hulud: Here We Go Again".
What to do now
- Remove the affected versions from development, build and CI/CD environments, and replace them with versions that are not on the list.
- Treat any machine that installed them as potentially compromised and rebuild it.
- Rotate exposed credentials: hosting and cloud keys, GitHub and npm tokens, SSH keys, database passwords, payment and email API keys.
- Check cloud, hosting and code accounts for access you do not recognise since the install.
- For the future, ask your developer about pinning versions and turning off install scripts in automated builds where possible.
- Projects that did not install or update packages in that window are most likely not affected, but the check is quick.
This alert reports what the sources published and is not a guarantee about any specific site.