--- title: "Mini Shai-Hulud's Latest Wave: 280 New Places" url: https://daily.dev/posts/mini-shai-hulud-s-latest-wave-280-new-places-t4zfxdptc source_url: https://blog.gitguardian.com/keyv-mini-shai-hulud type: article source: "GitGuardian" published: 2026-08-07T13:12:23.329Z updated: 2026-08-10T14:02:03.788Z tags: ["cyber", "malware", "npm", "secrets-management", "gitguardian"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Mini Shai-Hulud's Latest Wave: 280 New Places **[GitGuardian](https://daily.dev/sources/gitguardian)** · 4 min read · 0 upvotes · 0 comments ## Summary A new wave of the Mini Shai-Hulud malware campaign infected the keyv@6.0.0 npm package on Aug. 4, 2026, spreading to 800+ packages across thousands of versions and affecting namespaces of companies like Qlik and Picsart. The malware uses an npm preinstall script to download the Bun runtime and execute an obfuscated second-stage payload. The key evolution in this iteration is the expansion of secret collection locations from 189 to 469 hardcoded file paths, now targeting AI agent configs (Cursor, OpenAI Codex, Gemini), CI/CD tools (ArgoCD, Jenkins, CircleCI), cryptocurrency wallets (Solana, Electrum), and cloud providers (Hetzner, Alibaba, Tencent). The new version also enumerates secrets across all system users rather than just the current user's home directory, and can retrieve its C2 server address from the Ethereum blockchain. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What packages were affected by the keyv npm supply chain attack in the Mini Shai-Hulud campaign? The keyv@6.0.0 package was the initial infection vector, published at 9:35 a.m. UTC on Aug. 4, 2026. The compromise chain spread to more than 800 packages across thousands of versions, including @cacheable/memory, ecto, cacheable-request, and flat-cache. Company namespaces affected included OneReach, Ornikar, Qlik, and Picsart. The last malicious package was published at 12:27 a.m. UTC on Aug. 5, 2026. _Teams auditing npm dependencies for this campaign can track new waves and affected packages on daily.dev._ ### How does the Mini Shai-Hulud malware collect secrets and what new locations does the latest version target? Mini Shai-Hulud collects secrets from the local file system, local execution environment, CI/CD runners, AWS, Kubernetes, and Vault. The latest version expanded file system targets from 189 to 469 hardcoded locations, adding AI agent configs (Cursor, OpenAI Codex, Gemini), CI/CD tools (ArgoCD, Jenkins, CircleCI), cloud providers (Hetzner, Alibaba, Tencent), and crypto wallets (Solana, Electrum, Foundry, Brownie). It now also enumerates secrets across all system users, not just the current user. _Developers hardening endpoints against infostealers find the latest threat intelligence on daily.dev._ ### How does the Mini Shai-Hulud malware persist on infected systems? Mini Shai-Hulud persists by poisoning Claude and VS Code configuration files. It uses an npm preinstall script — disabled by default since npm version 12 — to download the Bun runtime and execute an obfuscated JavaScript payload named Math_Symbol.js. Secrets are exfiltrated to GitHub, and the latest version retrieves its command-and-control server address from the Ethereum blockchain. _Knowing which config files infostealers poison helps developers prioritize what to revoke — daily.dev surfaces these writeups as they emerge._ ## Similar posts on daily.dev - [New Shai-Hulud malware wave compromises 600 npm packages](https://daily.dev/posts/new-shai-hulud-malware-wave-compromises-600-npm-packages-fc6izpxyv) · BleepingComputer · 5 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm), [#secrets-management](https://daily.dev/tags/secrets-management), [#gitguardian](https://daily.dev/tags/gitguardian) [View this post on daily.dev](https://daily.dev/posts/mini-shai-hulud-s-latest-wave-280-new-places-t4zfxdptc)