--- title: Fast-Moving Shai-Hulud Attack Infects npm Packages with... description: A rapidly spreading supply-chain attack dubbed Shai-Hulud has compromised over 1,280 npm packages with a combined 2+ billion monthly downloads. Attackers... canonical: https://daily.dev/posts/fast-moving-shai-hulud-attack-infects-npm-packages-with-2-billion-monthly-downloads-2wmc5vjuj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fast-Moving Shai-Hulud Attack Infects npm Packages with 2 Billion Monthly Downloads | daily.dev og:description: A rapidly spreading supply-chain attack dubbed Shai-Hulud has compromised over 1,280 npm packages with a combined 2+ billion monthly downloads. Attackers... og:url: https://daily.dev/posts/fast-moving-shai-hulud-attack-infects-npm-packages-with-2-billion-monthly-downloads-2wmc5vjuj og:image: https://api.daily.dev/og/posts/2WMC5vJuj.png og:image:alt: Fast-Moving Shai-Hulud Attack Infects npm Packages with 2 Billion Monthly Downloads og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fast-Moving Shai-Hulud Attack Infects npm Packages with 2 Billion Monthly Downloads **[DevOps.com](https://daily.dev/sources/devops)** · 6 min read · 0 upvotes · 0 comments ## Summary A rapidly spreading supply-chain attack dubbed Shai-Hulud has compromised over 1,280 npm packages with a combined 2+ billion monthly downloads. Attackers hijacked the GitHub account of jaredwray, maintainer of keyv (127M weekly downloads), and pushed malicious files directly to the main branch, publishing poisoned versions with valid GitHub Actions provenance signatures. The malware executes automatically during npm install via a preinstall hook, downloads the Bun runtime, and runs a heavily obfuscated 728 KB payload (Math_Symbol.js) that steals npm/GitHub tokens, AWS credentials, Kubernetes secrets, HashiCorp Vault tokens, SSH keys, Stripe/Slack tokens, Terraform state files, and more. Stolen data is exfiltrated to a public GitHub repository. The worm spreads by using harvested tokens to publish malicious versions of additional packages, infecting 50–100 new packages every few minutes. Affected organizations include Deliveroo, OneReach, ServiceTitan, Picsart, and Qlik. Recommended mitigations include pinning/rolling back packages to pre-compromise versions, rotating all credentials on affected machines, and using --ignore-scripts in CI pipelines. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [New Shai-Hulud malware wave compromises 600 npm packages](https://daily.dev/posts/new-shai-hulud-malware-wave-compromises-600-npm-packages-fc6izpxyv) · BleepingComputer · 5 upvotes · 1 comments - [Shai-Hulud: Here We Go Again. Mass npm Supply Chain Attack Hits the AntV Ecosystem](https://daily.dev/posts/shai-hulud-here-we-go-again-mass-npm-supply-chain-attack-hits-the-antv-ecosystem-nq51smsqn) · StepSecurity · 1 upvotes · 0 comments - [Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised](https://daily.dev/posts/mini-shai-hulud-strikes-again-317-npm-packages-compromised-u2ptexbxr) · Hacker News · 2 upvotes · 0 comments - [Shai-Hulud copycat worm infects yet another npm package](https://daily.dev/posts/shai-hulud-copycat-worm-infects-yet-another-npm-package-6qyti32ms) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/fast-moving-shai-hulud-attack-infects-npm-packages-with-2-billion-monthly-downloads-2wmc5vjuj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fast-Moving Shai-Hulud Attack Infects npm Packages with 2 Billion Monthly Downloads","url":"https://daily.dev/posts/fast-moving-shai-hulud-attack-infects-npm-packages-with-2-billion-monthly-downloads-2wmc5vjuj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fast-moving-shai-hulud-attack-infects-npm-packages-with-2-billion-monthly-downloads-2wmc5vjuj"},"datePublished":"2026-08-04T15:36:03.165Z","dateModified":"2026-08-05T02:09:06.407Z","description":"A rapidly spreading supply-chain attack dubbed Shai-Hulud has compromised over 1,280 npm packages with a combined 2+ billion monthly downloads. Attackers...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/177ad7bd5fd5ade3a7ac5adaefedeb2f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/177ad7bd5fd5ade3a7ac5adaefedeb2f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fast-moving-shai-hulud-attack-infects-npm-packages-with-2-billion-monthly-downloads-2wmc5vjuj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware,github-actions,npm","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"Fast-Moving Shai-Hulud Attack Infects npm Packages with 2 Billion Monthly Downloads"}]} ```