keyv is not some exotic dependency. It’s the thing three layers under the thing you actually installed — flat-cache, file-entry-cache, cacheable-request, the whole family, two billion downloads a month between them. I went looking through my own lockfiles after reading this and found it in more places than I’d have guessed. That’s the part that stings: I didn’t choose it, my toolchain did.
The mechanism is depressingly simple. A preinstall hook in package.json, so npm install runs the dropper for you, which pulls down the Bun runtime and executes the real payload. Then it goes hunting for GitHub, npm and HashiCorp Vault tokens, AWS and Azure credentials, Stripe and Slack logins, Kubernetes secrets — and uses the stolen npm tokens to spread itself further.
What I’m actually doing: --ignore-scripts by default, and CI builds where the deploy token isn’t sitting in the same environment as the install step. If your Cloudflare or GitHub token can be read by anything npm install touches, that’s the bug, not the worm.
The story — The GitHub account of the keyv maintainer was compromised on 4 August in a Shai-Hulud supply-chain attack, spreading through keyv 6.0.0 and related packages to others including @picsart/ai-sdk and picasso.js. Aikido Security identified 1381 malicious versions across 444 npm packages on 5 August; Socket now counts over 2400 infected artefacts. The payload, dubbed ChainDrop by StepSecurity, exfiltrates encrypted credentials to attacker-controlled public GitHub repositories marked “Shai-Hulud: Here We Go Again”. (Source)