Shai-Hulud npm Worm Used Valid Provenance to Poison 868 Packages
A hijacked GitHub account let the Shai-Hulud npm worm gain valid provenance, poison hundreds of packages, and expose a software supply-chain trust gap.
Summary
**Verified facts, incident:** On August 4, 2026, an attacker seized the GitHub account of the developer maintaining keyv, an npm key-value library downloaded about 127 million times per week. The attacker placed malicious files in repositories controlled by the maintainer and released compromised versions of keyv and related caching packages. Aikido subsequently counted at least 868 affected packages across 1,381 versions, representing more than two billion combined monthly installs. JFrog separately identified more than 400 packages and 1,700 poisoned versions; the differing totals reflect independent tracking, and both remained incomplete at publication.
**Verified facts, provenance failure:** The malicious releases carried genuine npm provenance attestations rather than forged signatures. Because the attacker used the maintainer’s repositories and GitHub Actions workflows, npm correctly certified that the builds originated from the declared release pipeline. Wiz corroborated that path. JFrog also documented an opensearch-js workflow that obtained an OIDC token, exchanged it for publishing access and generated a Sigstore provenance bundle through Fulcio and Rekor. Provenance therefore verified the pipeline’s origin but could not establish whether the person or credential initiating it was authorized.
**Verified facts, spread and objectives:** After entering a developer machine or build runner, the worm searched for npm publishing credentials and used them to compromise additional packages controlled by victims. Stolen secrets were sent to public GitHub repositories bearing the campaign’s Shai-Hulud marker. Confirmed affected releases included packages under corporate scopes associated with Deliveroo, Qlik and Picsart. JFrog and Wiz found extractors targeting cloud keys, continuous-integration secrets and credentials for production infrastructure. Wiz also reported persistence files in Visual Studio Code and Anthropic Claude Code working directories, potentially allowing execution when an infected project was opened or an AI coding session began.
**Verified facts, broader context:** CrowdStrike’s 2026 Threat Hunting Report, published one day before the incident, identified registries, CI pipelines, container registries and development extensions as direct targets. It attributed 87% of malicious software-registry threats observed during the first half of 2026 to npm packages and reported a 171% rise in cloud-focused criminal activity. CrowdStrike also found that 88% of observed exploitation involving vulnerabilities with public proof-of-concept code occurred within 48 hours. Adam Meyers said roughly 43,000 CVEs had already been registered in 2026, compared with about 48,200 during all of 2025.
**Interpretation, why it matters:** The incident demonstrates a limitation of cryptographic provenance, not evidence that provenance itself was broken. A valid attestation can prove which workflow built a package while still endorsing malicious output if an attacker controls the authorized account, token or repository. Organizations using keyv indirectly were exposed through dependency chains they may not have knowingly selected. The case consequently shifts attention toward maintainer identity, token scope, CI runner security and the treatment of developer workstations as highly privileged assets.
**What happens next:** npm 12, released in mid-2026, requires approval for preinstall, install and postinstall hooks; JFrog said this default stops the worm’s preinstall payload from running during installation. npm CLI 11.10.0 also introduced `min-release-age` in February 2026, allowing teams to delay adoption of newly published versions, while pnpm had added a comparable control five months earlier. Incident response will require removing compromised releases, rotating exposed credentials and republishing clean packages. The final package count, the number of stolen secrets and the extent of downstream cloud access remained uncertain because the campaign was still expanding when the article was published.
Positives
- JFrog confirmed that npm 12’s default blocking of preinstall hooks prevents this worm from executing automatically during package installation.
- npm CLI 11.10.0 added the free `min-release-age` control in February 2026, enabling organizations to quarantine newly released package versions before adoption.
- pnpm introduced its comparable `minimumReleaseAge` feature five months before npm, giving its users an established way to delay potentially dangerous releases.
- Aikido, JFrog and Wiz independently investigated the campaign, providing multiple sources of evidence about package counts, release workflows, credential theft and persistence.
- GitHub had already mandated two-factor authentication for npm publishing, revoked legacy non-expiring tokens and introduced trusted publishing, although the incident exposed remaining identity risks.
Risks & concerns
- One compromised GitHub maintainer account led to at least 868 affected packages and more than two billion combined monthly installs in Aikido’s count.
- The poisoned releases received legitimate provenance attestations because the attacker operated through trusted repositories and GitHub Actions workflows.
- The malware searched for cloud keys, CI secrets, npm publishing tokens and production credentials, allowing a package compromise to threaten downstream infrastructure.
- Wiz found persistence mechanisms targeting both Visual Studio Code and the `.claude` directory used by Claude Code, extending the threat beyond package installation.
- Organizations using npm versions older than 12 remained exposed to automatic execution through the worm’s preinstall script.
- CrowdStrike observed 88% of exploitation involving public proof-of-concept code within 48 hours, making traditional monthly remediation cycles inadequate for fast-moving threats.