A new wave of the Mini Shai-Hulud malware campaign infected the keyv@6.0.0 npm package on Aug. 4, 2026, spreading to 800+ packages across thousands of versions and affecting namespaces of companies like Qlik and Picsart. The malware uses an npm preinstall script to download the Bun runtime and execute an obfuscated second-stage payload. The key evolution in this iteration is the expansion of secret collection locations from 189 to 469 hardcoded file paths, now targeting AI agent configs (Cursor, OpenAI Codex, Gemini), CI/CD tools (ArgoCD, Jenkins, CircleCI), cryptocurrency wallets (Solana, Electrum), and cloud providers (Hetzner, Alibaba, Tencent). The new version also enumerates secrets across all system users rather than just the current user's home directory, and can retrieve its C2 server address from the Ethereum blockchain.
Table of contents
How the Mini Shai-Hulud infection chain works469 secret locations: how the collection scope expandedWhy npm supply chain attacks keep adaptingQuestions this post answers
What packages were affected by the keyv npm supply chain attack in the Mini Shai-Hulud campaign?
The keyv@6.0.0 package was the initial infection vector, published at 9:35 a.m. UTC on Aug. 4, 2026. The compromise chain spread to more than 800 packages across thousands of versions, including @cacheable/memory, ecto, cacheable-request, and flat-cache. Company namespaces affected included OneReach, Ornikar, Qlik, and Picsart. The last malicious package was published at 12:27 a.m. UTC on Aug. 5, 2026. Teams auditing npm dependencies for this campaign can track new waves and affected packages on daily.dev.
How does the Mini Shai-Hulud malware collect secrets and what new locations does the latest version target?
Mini Shai-Hulud collects secrets from the local file system, local execution environment, CI/CD runners, AWS, Kubernetes, and Vault. The latest version expanded file system targets from 189 to 469 hardcoded locations, adding AI agent configs (Cursor, OpenAI Codex, Gemini), CI/CD tools (ArgoCD, Jenkins, CircleCI), cloud providers (Hetzner, Alibaba, Tencent), and crypto wallets (Solana, Electrum, Foundry, Brownie). It now also enumerates secrets across all system users, not just the current user. Developers hardening endpoints against infostealers find the latest threat intelligence on daily.dev.
How does the Mini Shai-Hulud malware persist on infected systems?
Mini Shai-Hulud persists by poisoning Claude and VS Code configuration files. It uses an npm preinstall script — disabled by default since npm version 12 — to download the Bun runtime and execute an obfuscated JavaScript payload named Math_Symbol.js. Secrets are exfiltrated to GitHub, and the latest version retrieves its command-and-control server address from the Ethereum blockchain. Knowing which config files infostealers poison helps developers prioritize what to revoke — daily.dev surfaces these writeups as they emerge.