I ran npm install this morning without thinking. Same command I've typed a thousand times. That reflexive trust is exactly what attackers are exploiting right now. A live supply chain attack has already poisoned hundreds of npm packages, and it started with something stupidly simple: one developer's stolen GitHub password.

The keyv library went first. It's a key-value storage tool that pulls in roughly 127 million downloads every week. Most developers have it in their node_modules without ever knowing the name. The maintainer's account got compromised, and the attacker didn't stop there. Same person owns cacheable, flat-cache, file-entry-cache, cache-manager, and cacheable-request. Those packages individually rack up hundreds of millions of monthly installs. This wasn't some obscure library with five downloads. It was infrastructure so ordinary that nobody questions it.

The Worm Activates Before You Even Notice

The malicious code runs through a preinstall script, which means it executes before your install command even finishes. From there it hunts. It grabs npm authentication tokens from.npmrc files. Pulls GitHub CLI tokens including personal access tokens and OIDC tokens. Digs into ~/.aws/credentials for AWS access keys. Siphons secrets from Kubernetes and HashiCorp Vault setups if they're lying around.

Security researchers tied the payload to "Shai-Hulud," a malware family that first appeared in 2025 and has cycled through variants ever since. But here's what makes it genuinely nasty: it doesn't just steal. It uses those credentials to publish poisoned versions of the victim's own packages. Your GitHub tokens publish malware under your name. Your npm tokens push infected versions as if you did it. Your AWS keys could be used for anything. It's a worm because it turns the victim's own credentials into a self-replicating weapon.

What You Need to Do Right Now

Rotate every local credential you have. All of them. If you've got an npm token, GitHub token, AWS access key, or Vault secret sitting in a config file, assume it's compromised if you've installed any of those packages. Audit your lockfiles for poisoned versions. Check what actually got installed in the versions you're using. Disable non-essential npm install scripts if your workflow allows it, because that's the attack vector that's hardest to patch.

The real problem is that npm package managers execute code during installation by default. It's a design choice that made sense years ago. It's also the reason a single compromised account can turn into a worm that spreads across billions of devices. You can't patch your way out of this one. You can only rotate, audit, and hope you caught it before the credentials went anywhere else.

This article is for informational purposes. It is not financial or security advice. Always follow your organization's security protocols and consult with security professionals regarding your systems.