A compromised developer account injected a worm into the programming library Keyv on August 4, 2026, which spread to 444 packages in the npm registry within a few hours. The affected packages account for more than two billion monthly downloads combined. The malware specifically searches infected machines for credentials of AI programming tools such as Claude Code and Cursor.
Compromised maintenance account spreads malicious code within hours
According to the security company Wiz, the attack began around 9 AM UTC. Unknown attackers injected malicious code directly into the main branch of the repository via the compromised GitHub account of Keyv maintainer Jared Wray and published the manipulated version 6.0.0.
From there, the worm spread automatically. Using stolen credentials, it published 2,212 manipulated versions across 444 packages within four hours, including cache-manager, flat-cache, and file-entry-cache, as well as packages from large companies like Qlik. Keyv itself accounts for more than 150 million weekly downloads. A prepared installation command downloaded the JavaScript runtime Bun and launched a roughly 710-kilobyte obfuscated second-stage payload.
Malware specifically targets credentials of AI tools
The second stage searches infected systems for classic targets such as npm and GitHub tokens, cloud credentials for AWS and Google Cloud, and Kubernetes and HashiCorp Vault secrets. According to Wiz, the malware belongs to the Shai-Hulud family and carries a target list roughly 70 percent larger than earlier variants. It now explicitly includes configuration files from Claude Code, Cursor, Gemini, and OpenAI’s Codex.
For persistence, the malware also writes its own hooks into Claude Code settings and the VS Code file tasks.json, so it runs again at the start of every new session. Already in July, a similar case involving the package Jscrambler harvested credentials from Claude Desktop and other AI tools. The new campaign, however, far exceeds that case in reach and automated self-propagation.
Command infrastructure runs through an Ethereum smart contract
Instead of fixed servers, the malware uses a smart contract on the Ethereum blockchain to dynamically retrieve the addresses of its control servers, according to analyses by StepSecurity. Security researchers call this technique EtherHiding. The malware additionally encrypts stolen data before exfiltrating it via the domain npm-cache.com.
Wray confirmed the account compromise and stated he had used OpenID Connect rather than permanent access tokens for npm. He also announced a full audit of his accounts. According to CSO Online, the manipulated versions were removed within two hours of discovery, and Wray regained access to his account around 8 PM UTC. Security teams advise development teams to remove affected packages, rotate npm, GitHub, cloud, and Kubernetes credentials, and specifically check systems for persistence files in the .claude and .vscode folders.
It remains unclear how many of the installations downloaded worldwide actually received a manipulated version – this is independently unverified, as the security firms involved have so far only disclosed the number of published malicious versions, not infection counts. The incident does show, however, that credentials for AI coding assistants now count as a standalone attack target, no longer just collateral alongside cloud and crypto credentials.
