---
id: 5715
title: "Keyv and friends compromised in active Shai-Hulud supply chain attack"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack"
published_at: "2026-08-04T00:00:00Z"
tags: ["supply-chain", "incident-response", "malware", "credential-theft", "github-actions", "npm", "shai-hulud", "keyv"]
phying_url: "https://phying.com/item/5715"
lang: en
---

# Keyv and friends compromised in active Shai-Hulud supply chain attack

## Summary

Attackers hijacked the maintainer account behind keyv (127M weekly downloads) and its caching-package family, injecting a credential-stealing Shai-Hulud worm that spread to 444+ npm packages.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-08-04T00:00:00Z
- **Original:** https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
- **Phying News:** https://phying.com/item/5715