Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Keyv and friends compromised in active Shai-Hulud supply chain attack

aikido.dev | incident | #supply-chain | #incident-response | #malware | #credential-theft | #github-actions | #npm | #shai-hulud | #keyv

Summary

Attackers hijacked the maintainer account behind keyv (127M weekly downloads) and its caching-package family, injecting a credential-stealing Shai-Hulud worm that spread to 444+ npm packages.
Published
Collected

original ↗

Related coverage

incident · wiz.io
keyv and cacheable npm Package Hijacked in Supply Chain Attack
Wiz: keyv/cacheable packages were hijacked via a maintainer account; a Mini Shai-Hulud descendant hit 400+ packages, stealing credentials, AI configs and wallets; C2 via an Ethereum contract.
blog · wiz.io
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.
incident · wiz.io
Miasma: Supply Chain Attack Targeting RedHat npm Packages
Wiz Research found Miasma, a supply-chain attack on @redhat-cloud-services npm: 32+ tampered releases (~80k weekly downloads) carried a Shai-Hulud-derived payload targeting GCP and Azure identities.
incident · netspi.com
LiteLLM Supply Chain Compromise
Malicious PyPI builds of LiteLLM 1.82.7/1.82.8, published via a compromised maintainer account, exfiltrated API keys and system data, exposing a user's entire LLM provider surface.
incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
blog · aikido.dev
Shai-Hulud Rises From the Dead after 111 days
The Shai-Hulud npm worm payload behind May's @AntV attack resurfaced after 111 days: four new packages on September 7 carried the identical hash, despite npm's new publish-time malware scanning.
back