Supply Chain Security
Shai-Hulud Returns: keyv, cacheable and 800+ npm Packages Hijacked by a Self-Replicating Worm
A compromised maintainer account pushed a preinstall dropper into keyv, cacheable, flat-cache and file-entry-cache on August 4, 2026. The payload fetches its own Bun runtime, drains cloud and CI credentials, and republishes itself through npm trusted publishing.