A new npm worm has infected at least 444 software packages and more than 2,000 package versions, putting applications with over two billion combined monthly installs at risk.
The malware is spreading through stolen developer credentials and automatically poisoning additional packages. Security researchers warn that affected organisations should assume their systems and secrets may have been exposed.
Wiz, a cloud security company, said the attack spread across a major part of the open-source ecosystem in less than 24 hours. The incident began after attackers compromised the GitHub account of developer Jared Wray on August 4.
Wray maintains keyv and cacheable, two widely used open-source projects for JavaScript data management and caching.
Compromised Maintainer Account Starts Massive npm Worm
The first known malicious release was keyv version 6.0.0. That package alone receives around 604 million monthly downloads.
Attackers quickly followed with infected releases of other popular packages, including cacheable, flat-cache, and file-entry-cache. Flat-cache and file-entry-cache receive roughly 565 million and 557 million monthly downloads respectively.
Once installed or updated, the malicious packages can fully compromise a developer’s system. The malware steals credentials from .env files, npm and GitHub tokens, AWS and Kubernetes secrets, SSH keys, VPN configurations, and more than 200 other credential types.
The worm then uses stolen publishing tokens to infect packages owned by other compromised maintainers.
Aikido said it had observed active community spread affecting additional maintainers, packages, and major organisations.
Malware Uses Preinstall Hook to Spread
StepSecurity said every poisoned version uses the same infection method. A preinstall dropper downloads the legitimate Bun JavaScript runtime and then launches a 710KB obfuscated second-stage payload.
The payload steals credentials, publishes more malicious packages, and modifies AI development tools.
Researchers identified the malware as an evolved descendant of Shai-Hulud 2.0, one of several npm worms that have targeted the ecosystem this year. The malicious code reportedly includes markers from earlier Shai-Hulud campaigns and creates public GitHub repository descriptions reading: “Shai-Hulud: Here We Go Again.”
Microsoft said the malware can identify packages available to a compromised npm account, download their latest tarballs, inject malicious code and a setup loader, add a preinstall hook, increase the patch version, and republish the altered package.
New Features Target AI Tools and Crypto Wallets
The latest npm worm also creates persistence by modifying Claude and Visual Studio Code configuration files in infected repositories.
It retrieves command-and-control domains from the Ethereum blockchain, which could let its operators change infrastructure without updating the malware itself. Researchers also found that it targets 70% more credential sources than earlier variants.
New targets include Claude, OpenAI, Codex, Cursor, Gemini, and cryptocurrency keystores connected to Foundry, Solana, and Monero.
Wiz said the malware also contains an updated dead-man’s switch that can be selectively activated based on a response from its command-and-control server.
Security firms recommend that affected developers and organisations immediately rotate all credentials, inspect repositories and released packages for signs of compromise, clean infected systems, and introduce stronger protections against supply chain attacks.
The full scale of the incident remains unclear. Because the worm spreads through maintainer credentials, researchers warn that thousands of accounts could already be compromised.
0 responses to “npm Worm Infects 444 Packages With 2 Billion Monthly Downloads”