Shai-Hulud npm worm (Aug 2026): check, remediate, prepare | Faceless AI - Dataspheres AI

Incident guide · August 4–5, 2026 · npm ecosystem On August 4, attackers hijacked the GitHub account of the maintainer of keyv and its ...

Incident guide · August 4–5, 2026 · npm ecosystem On August 4, attackers hijacked the GitHub account of the maintainer of keyv and its sibling caching libraries, publishing a self-propagating credential-stealing worm ("Shai-Hulud: Here We Go Again") across roughly 868 packages and 1,381 versions — over two billion monthly installs. The worm ships two files ( setup.mjs , Math_Symbol.js ) and adds a preinstall hook; it exfiltrates secrets and plants persistence hooks in editor config files. Check if you're affected (2 minutes) Sweep node_modules and your pnpm store for the dropped files: fd -HI "^(setup.mjs|Math_Symbol.js|math_init.js)$" (grep works too, fd is faster). Scan your exact dependency list for known advisories with our free scanner: dataspheres.ai/depwatch — paste package.json, no signup. If you installed any keyv-family update on Aug 4–5: rotate every secret that was present in the environment where install ran, and audit recent pushes from CI tokens. Remediate Pin back to the last known-good versions and rebuild lockfiles from them; delete and reinstall node_modules after the sweep above comes back clean. Treat any newly added pre/post-install hook in a dependency diff as a blocking review event — hook additions were the tell in this wave. Note from StepSecurity's payload analysis: provenance worked as designed and still shipped malware — signatures authenticate the publisher, not the payload. Don't treat signed/provenance-attested as safe. Prepare for the next one Version cooldown — the highest-leverage fix almost nobody deploys. This worm was flagged same-day; CI that refuses versions younger than 5–7 days was never exposed. (pnpm: minimumReleaseAge ; Renovate: minimumReleaseAge ; npm: gate in CI — our scanner flags releases inside your window.) --ignore-scripts by default; allowlist the few packages that genuinely need install scripts. Watch your actual dependency list against the advisory feed instead of the news: DepWatch members can save a package.json and get an email only when NEW advisories appear against it. Sources: the live incident thread (news.ycombinator.com/item?id=49166874), StepSecurity's chaindrop analysis linked therein, OSV.dev advisory data. Checks in this guide are the thread's own converged mitigations, attributed in the discussion.