We have stopped counting the number of waves in the Shai-Hulud attack series, but this week has seen the rise of yet another iteration.
This campaign started with the infection of the keyv@6.0.0 npm package at 9:35 a.m. UTC on Aug. 4, 2026, and quickly spread across the ecosystem. The compromise chain reportedly affected more than 800 packages across thousands of versions, including:
@cacheable/memoryectocacheable-requestflat-cache- and more
The infection spread into the npm namespace of several well-known companies, including:
- OneReach
- Ornikar
- Qlik
- Picsart
The last known malicious package was published at 12:27 a.m. UTC on Aug. 5, 2026.
How the Mini Shai-Hulud infection chain works
The infection mechanism used in this campaign is very familiar. It relies on an npm preinstall script, a mechanism that has been disabled by default since npm version 12. This script uses the same mechanism we have observed in similar campaigns: it downloads the Bun execution environment and uses it to load a heavily obfuscated JavaScript second-stage file named Math_Symbol.js.
Once deobfuscated, it is clear that this malware is part of the Mini Shai-Hulud family, whose source code was open-sourced by the Team PCP threat actor in May 2026. The main payload shares the key characteristics we know from this family of malware:
- Aims for secrets, both locally and on remote systems.
- Distinctively targets developers' endpoints and CI/CD runners.
- Exfiltrates secrets to GitHub, including with a previously compromised key.
- Persists through poisoning of Claude and VS Code configuration files.
There are a few key novelties in this version worth noting. For example, the new version can download its command-and-control server address from the Ethereum blockchain. This mechanism is new to the Mini Shai-Hulud family, but the GlassWorm malware already used it in March 2026.
The true evolution, however, lies in the expanded scope of the collection.
469 secret locations: how the collection scope expanded
The Mini Shai-Hulud malware family is known for collecting secrets both locally and remotely. To do so, it uses distinct providers that target specific services:
- The local file system
- Local execution environment
- CI/CD runner environments
- AWS
- Kubernetes
- Vault
The list of collectors has not changed with the new version. Instead, the scope of what each collector accesses has changed.
The clearest example of this evolution is the file system provider, which is responsible for collecting secrets from developer machines. The open-source version of the malware collected secrets from a list of 189 hardcoded locations across Linux, Windows, and macOS environments. This new version raises the count to 469.
On Windows and macOS, the added paths mostly represent a catch-up with the previous version's Linux collector. On Linux, however, the changes are much more significant.
First, the malware now tries to exploit elevated privileges to collect secrets from more locations. Previous versions only targeted files stored in the current user's home directory; the new one enumerates files across all users on the system, including administrative users. This means the impact of an execution with high privileges would be much more severe.
The malware also expands the scope of its secret hunting by targeting configuration files for additional services and software, primarily AI agents, CI/CD software, cryptocurrency wallets, and cloud tools: the kinds of software most commonly found on developer machines.
- AI agents: Cursor, OpenClaw, OpenAI Codex, OpenCode, Gemini, Hermes
- CI/CD: ArgoCD, Jenkins, CircleCI
- Cloud: Hetzner, Alibaba Cloud, Tencent Cloud
- Cryptocurrency: Foundry, Brownie, Solana, Electrum
The other collectors remain unchanged. They already collect most of the data they can access.
Why npm supply chain attacks keep adapting
Every new supply chain attack campaign comes with its own set of improvements. They sometimes arise in response to security hardening efforts and are sometimes purely functional.
In recent months, we have seen threat actors adapt to the evolving security of the open-source ecosystem. The clearest example has been their adoption of OpenID Connect (OIDC) and attestations for package publication, a response to defenses introduced since the original Mini Shai-Hulud campaign in May 2026.
This new iteration does not represent a huge technological leap, but it still improves on past campaigns. The increase in the scope of endpoint harvesting is not anecdotal; it shows threat actors are refining their understanding of secrets sprawl, especially on the endpoint. It is reasonable to expect future waves will further refine this part of the malware.
With such a fast-moving threat, understanding where your credentials live has never been more important. That is why we, at GitGuardian, have been building our endpoint protection solution: so you know where your secrets live, which ones you can remove before an attack happens, and which ones you need to revoke once an infostealer campaign hits you.
Don't let attackers know where to find your secrets better than you do.
Soujanya Ain
Katie DeMatteis
