In less than four hours early Tuesday, an attacker compromised a GitHub maintainer account and unleashed a self-replicating piece of malware which injected malicious code into more than 440 distinct npm packages, according to multiple security firms.
Initial compromise: keyv and the maintainer account
Security researchers say the campaign began in keyv, a data management interface package that the source notes has more than 600 million monthly downloads. The attacker then spent roughly 30 minutes compromising additional packages controlled by the same maintainer, including cacheable, flat-cache and file-entry-cache, before the operation spread to packages governed by other maintainers.
Ilyas Makari, a malware researcher at Aikido Security, documented the wave in a blog post and described how the worm — built on the open‑source Mini Shai‑Hulud repository that TeamPCP published in May — propagated through npm packages after the initial account takeover.
Scale and reach: 440 packages in under four hours — and higher counts reported
Multiple firms measured the attack as both rapid and wide. The first reporting described more than 440 distinct npm packages compromised in that initial window. Aikido and others later reported the campaign eventually touched more than 860 packages with a "combined total of over 2 billion monthly installs," Makari wrote.
Wiz Research called the early compromise "the most critical initial compromise, with over 155 million weekly downloads on the root packages," and said some of the affected packages — including keyv, flat-cache and file-entry-cache — are present in more than 46% of all cloud environments. By comparison, Wiz noted, "back in the Shai‑Hulud 2.0 campaign the most prevalent packages were only in about 28% of environments."
Wiz also told CyberScoop it had not observed any new malicious packages since the initial wave moved through "a massive footpoint of cloud and code environments" during those first four hours.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble →Payload and behavior: what the Mini Shai‑Hulud variant does
Researchers describe the injected code as a Mini Shai‑Hulud variant with self‑replicating worm behaviour and credential theft built into the payload. The malware "scoops up a trove of sensitive data, including npm, GitHub, AWS and continuous integration credentials," according to the reporting, and also steals AI‑related configuration files and cryptocurrency wallets.
Microsoft, Aikido, Socket and Wiz all reported observing the same payload and pattern across affected packages, which the firms said indicates a single attacker or a threat cluster operating with multiple stolen tokens. The malware displayed a few pieces of new functionality but retained "the same core mechanisms that are hallmarks of Mini Shai‑Hulud," researchers wrote.
Response: indicators published and monitoring underway
Researchers from multiple firms "sprung into action" to monitor the spreading campaign and published indicators of compromise intended to help potential victims hunt for malicious activity. That public sharing of indicators and rapid analysis helped firms, at least according to Wiz, determine that the initial wave was the critical phase; Wiz reported it had not observed new malicious packages following that surge.
The consistent payload pattern observed by Microsoft, Aikido, Socket and Wiz provided an analytical basis for those indicators, and firms emphasized credential theft and token reuse as central risks for downstream victims.
How open‑source maintainers, technologists, and affected enterprises are positioned
- Open‑source maintainers: will need to watch for account compromise and token leakage tied to the targeted maintainer accounts and review the provenance of packages that depend on keyv, flat-cache and file-entry-cache, which the report shows are widely reused.
- Technologists and security teams: must hunt for exfiltrated credentials — npm, GitHub, AWS and CI tokens — and scan for the published indicators of compromise described by Microsoft, Aikido, Socket and Wiz; the malware’s ability to take AI configuration files and crypto wallets broadens the types of assets to check.
- Affected enterprises and procurement leaders: should note the reported scope — packages present in more than 46% of cloud environments and root packages with over 155 million weekly downloads — which implies widespread downstream exposure that could require prioritized remediation and token rotation.
Attribution, precedent, and a lingering question
Researchers observed the campaign’s codebase was built from the Mini Shai‑Hulud repository that TeamPCP published in May, and noted the evolution was "consistent with what we’ve seen from them in past waves." Wiz Research cautioned, however, that "we don't yet have the hard links" to confidently attribute this operation to TeamPCP.
The reporting also recalls that Google previously told CyberScoop it attributes TeamPCP to one core operator who was located in South Africa during at least some of the attacks, and that the actor previously compromised and injected malicious code into more than 1,000 software packages in less than four months earlier this year.
The swift, automated spread through packages with enormous reach — coupled with the malware’s focus on credentials, AI settings and wallets — makes this both a narrow technical incident and a broad supply‑chain event. Security firms have published indicators and tracking has so far found no new malicious packages after the initial surge, but as Wiz put it, "Time will tell whether the eventual cost and impact outpaces past attacks, or whether adoption of hardening mechanisms such as package aging, and the usage of the relatively less aggressive Mini Shai‑Hulud code as basis, will defray the final toll here."
