ChainDrop / Shai-Hulud — keyv/cacheable npm Worm (August 2026)

On 4 August 2026 an attacker in control of the GitHub account behind the keyv, cacheable and ecto npm package families pushed a credential-stealing worm directly to main and immediately cut releases. Because the malicious source was in the tagged repository state, the project's own release workflow built and published the poisoned tarballs with valid SLSA provenance signed by GitHub Actions. Every cryptographic check passes. The code is malware.

The attacker's objective is credentials, and then reach. Each compromised package adds "preinstall": "node setup.mjs" plus two payload files. setup.mjs is an 11 KB obfuscated loader whose only job is to obtain the Bun runtime (accepting any installed bun, otherwise downloading Bun v1.3.13 from GitHub releases into a temp directory named bun-dl-*) and run the 728 KB stage-2 stealer under Bun rather than under the npm-spawned Node process. The stealer harvests npm, GitHub, AWS, Kubernetes, Vault, Stripe, Slack and AI-assistant credentials, plus CI runner memory, then uses any working npm publish token to repack and republish other packages the token can reach. That self-propagation turned a handful of initial compromises into roughly 434–444 packages across ~1,381 versions, with tracking of up to 2,236 malicious package versions and a combined reach exceeding 2 billion monthly installs.

Two things make this wave meaningfully different from earlier Shai-Hulud activity, and both are the highest-value defensive angles:

• Bun as a monitoring-evasion runtime. Stage 2 never runs under Node. Any detection built on Node.js runtime internals, Node hooks, or npm's own script auditing is blind to it. Host-level process, file and network telemetry still sees everything — which is exactly what Section 8 hunts.
• Persistence in IDE and coding-agent configuration. The worm writes .vscode/tasks.json, .claude/settings.json, .claude/setup.mjs and .vscode/setup.mjs into up to 50 branches of every repository a stolen GitHub token can reach. The VS Code task runs on folderOpen; the Claude settings register a SessionStart hook. No npm install is required — merely opening the checkout re-detonates the loader. Cleaning node_modules does not clean this.

The C2 channel is also new: the payload holds no hardcoded domain. It iterates 73 public Ethereum RPC endpoints and makes an eth_call against a smart contract to retrieve the current exfiltration domain list, then HTTPS-GETs /router on port 443 of the first healthy domain. A signed GitHub commit-search fallback and a public-repository exfiltration fallback (repo description "Shai-Hulud: Here We Go Again") back it up. Blockchain RPC cannot be sinkholed or taken down.

This pack targets developer laptops and build agents, not servers. Those hosts are where npm installs happen, where IDEs open untrusted checkouts, and where GitHub, npm, cloud, signing and deployment credentials sit in plaintext files. Scope your hunt accordingly.

Defender priority: Query 1 and Query 4 first. Q1 catches the install-time detonation, Q4 catches the IDE-config re-detonation that survives dependency cleanup. If either fires, treat the host as credential-compromised and rotate from a clean system — but hunt and disable gh-token-monitor persistence (Q8) before revoking GitHub tokens, because the payload's dead-man switch watches for exactly that revocation.

Six sources were fetched and snapshotted verbatim on 2026-08-07 into KeyvShaiHulud-npm-Worm-Hunt-sources/. Every atomic indicator shipped in Section 10 traces to at least one of those snapshots. Indicators appearing in only one source are labelled below.

Web-hunter decisions

• Counts differ between sources and that is expected. Aikido says 444 packages / 1,381 versions at 13:15 CEST 2026-08-05; Cloudsmith says ~444 packages / 2,236 malicious versions; Strobes cites 868 packages / 1,381 versions at 13:37 CEST. All are snapshots of a live, growing incident. Treat any single number as a lower bound and re-derive package exposure from your own lockfiles, not from a published list.
• Cloudflare-fronted IPs are recorded but not blocked. Wiz published resolved addresses for the C2 and RPC hostnames. Two sit behind Cloudflare and one behind AWS; they are shared infrastructure. They appear in Section 4 as enrich only and are deliberately excluded from the Falcon import CSV.
• Ethereum RPC hostnames are not indicators of compromise on their own. Datadog notes the payload iterates 73 RPC endpoints that are "mostly legitimate public infrastructure". Only the three named by Wiz and Strobes are carried forward, and only as a process-correlated hunt (Q6), never as a block.
• No prompt-injection or instruction-bearing content was found in any fetched page. All six sources are ordinary vendor analysis. No source attempted to direct tooling behaviour or supply an indicator out of band.

Lineage — how this differs from the packs already in the library

Two Shai-Hulud-lineage packs already exist: Mini-Shai-Hulud and ShaiHulud-Hades-PyPI. This pack is the new August 2026 keyv wave and deliberately does not rehash those waves' indicators. Everything below is new to this wave: (1) the four :443/router C2 domains and the Ethereum StringListStore dead-drop resolver that replaces hardcoded domains; (2) the setup.mjs → Bun two-stage loader, which is a runtime-swap evasion the earlier waves did not use; (3) IDE-config persistence via .vscode/tasks.json and .claude/settings.json, giving an execution path with no npm install; (4) a new operator RSA encryption key and a new lock file tmp.dpkg_14527.lock; (5) malicious releases carrying valid GitHub-Actions-signed provenance. Wiz assesses the payload as a descendant of the public "Mini" Shai-Hulud / TeamPCP code base, so the earlier packs' behavioural hunts remain complementary — run them alongside this one, not instead of it.

Attack chain

Hunt hypotheses (ordered by fidelity)

Chain steps with no mappable Falcon telemetry (carried into the Coverage Map as gaps): step 1 (maintainer account takeover), step 2 (provenance signing), step 10 (C2-delivered eval()), and step 12 (GitHub branch infection). All four are visible only in GitHub/npm audit logs — see Section 7.

Confirmed maintainer-linked malicious releases

Snyk enumerated all 61 packages published by the maintainer and confirmed exactly 11 malicious releases, all carrying byte-identical payload files:

keyv@6.0.0 · @cacheable/net@2.1.1 · @cacheable/node-cache@3.1.2 · cacheable@2.5.1 · flat-cache@6.1.24 · @cacheable/memory@2.2.1 · cacheable-request@13.0.20 · file-entry-cache@11.1.6 · @cacheable/utils@2.5.1 · cache-manager@7.2.10 · ecto@5.0.1

Scope on the right versions. keyv@6.0.0 is the version every headline names, and it is the one nothing in a normal dependency tree resolves to — no caret range on v4 or v5 accepts a v6 major. The releases that install silently are the patch bumps sitting inside live caret ranges: cacheable-request@13.0.20, cache-manager@7.2.10 and @cacheable/utils@2.5.1. Prioritise those in lockfile sweeps. Beyond these 11, the worm propagated to roughly 434–444 further packages across ~1,381 versions (2,236 malicious versions by one count), so a fixed package list is a lower bound — hunt the behaviour and the payload hashes, not the names.

Four attack-chain steps are invisible to endpoint telemetry. These checks close them. Run the local sweeps on any host that installed an affected version, and the audit-log queries across the whole organisation.

7.1 — Local filesystem sweep (developer host / build agent)

Safe to run without executing package code. Covers both the npm-delivered payload and the IDE-config persistence that survives a node_modules wipe.

# 1. Payload and persistence artifacts anywhere under HOME and /tmp
find "$HOME" /tmp \
  \( -name setup.mjs -o -name Math_Symbol.js -o -name math_init.js \
     -o -name 'gh-token-monitor*' -o -name 'tmp.dpkg_14527.lock' \
     -o -name 'bun-dl-*' \) -print 2>/dev/null

# 2. Installed manifests carrying the exact lifecycle hook (no package code runs)
find node_modules -name package.json -print0 |
  xargs -0 node -e '
    const fs = require("node:fs");
    for (const file of process.argv.slice(1)) {
      try {
        const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
        if (pkg.scripts?.preinstall === "node setup.mjs") {
          console.log(pkg.name + "@" + pkg.version + " " + file);
        }
      } catch {}
    }
  '

# 3. Confirm by content hash, not by filename
find "$HOME" -type f \( -name '*.mjs' -o -name '*.js' \) -size -1000k \
  -exec shasum -a 256 {} + 2>/dev/null | grep -E \
  '9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc|fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb|54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668'

# 4. IDE / coding-agent persistence inside every local checkout
find "$HOME" -type d -name .git -prune -o \
  -path '*/.vscode/tasks.json' -print -o \
  -path '*/.claude/settings.json' -print -o \
  -path '*/.claude/setup.mjs' -print -o \
  -path '*/.vscode/setup.mjs' -print 2>/dev/null

# 5. Dead-man switch -- CHECK AND DISABLE BEFORE REVOKING ANY GITHUB TOKEN
ls -la ~/.local/bin/gh-token-monitor.sh ~/.config/gh-token-monitor/ \
       ~/.config/systemd/user/gh-token-monitor.service \
       ~/Library/LaunchAgents/com.user.gh-token-monitor.plist 2>/dev/null
systemctl --user list-units 'gh-token-monitor*' 2>/dev/null
launchctl list 2>/dev/null | grep -i gh-token-monitor

7.2 — Lockfile and dependency-tree exposure

# Resolved tree, including transitive paths
npm ls keyv flat-cache file-entry-cache cacheable-request cacheable \
  @cacheable/utils cache-manager @cacheable/net \
  @cacheable/node-cache @cacheable/memory ecto --all

# Lockfiles keep a pinned version alive after npm moves the dist-tag.
# Anchor on WHOLE package names -- substring matching produces false hits.
rg -n '"(keyv|flat-cache|file-entry-cache|cacheable-request|cacheable|cache-manager|ecto)"|"@cacheable/' \
  package-lock.json npm-shrinkwrap.json pnpm-lock.yaml yarn.lock

# The three that install SILENTLY inside live caret ranges -- check these first
rg -n 'cacheable-request@?13\.0\.20|cache-manager@?7\.2\.10|@cacheable/utils@?2\.5\.1' \
  package-lock.json pnpm-lock.yaml yarn.lock

# Which npm client, and can lifecycle scripts run at all?
npm --version ; npm config get ignore-scripts

7.3 — GitHub organisation audit log

7.4 — npm registry and private mirror

• Review your own npm org publish history for unexpected patch-version releases in the incident window — the worm always bumps the patch and replaces the entire scripts object with {"preinstall":"node setup.mjs"}. That replacement also breaks legitimate build/test scripts, which is a useful secondary tell.
• Check granular npm tokens for bypass_2fa: true combined with package-write. Those are the tokens the propagation path requires.
• Purge affected versions from private registries, proxies and developer caches. npm's own removal of a version does not delete copies already cached by an internal proxy.

7.5 — Cloud and secret-store audit

• CloudTrail: sts:GetCallerIdentity followed within minutes by secretsmanager:ListSecrets / GetSecretValue and ssm:DescribeParameters / GetParameters with WithDecryption=true, iterating many regions from one source. The collector pages DescribeParameters at 50 and batches GetParameters at 10 across 17 commercial regions — that multi-region fan-out from a build identity is the signature.
• Kubernetes audit: list on namespaces then get/list on secrets across non-system namespaces by a service account that has no business doing so.
• Vault audit device: sys/mounts enumeration followed by broad KV reads capped at 100 top-level keys per mount.

No query carries an in-query time filter. Set the window in the Falcon console instead — @timestamp compared against an expression such as now() - N is rejected by the parser and would stop every query on line 1. Start with a 30-day window: the campaign began 2026-08-04 and installs are bursty.

// HUNT: npm/yarn/pnpm preinstall hook launching the keyv-shai-hulud stage-1 loader
// MITRE: T1195.002, T1059.007 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 on developer workstations and CI build agents
// TUNING: if a sanctioned internal package genuinely ships setup.mjs, exclude it by its
//         full path in CommandLine -- never by suppressing the node+setup.mjs pair itself
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^node(\.exe)?$/i
| CommandLine=/setup\.mjs/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid])

// HUNT: Bun runtime executing the keyv-shai-hulud stage-2 credential stealer
// MITRE: T1059.007, T1027 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 (macOS, Linux and Windows dev / CI hosts)
// TUNING: none needed. Math_Symbol.js and math_init.js are campaign filenames with no
//         legitimate counterpart -- treat every hit as a confirmed stage-2 execution
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^bun(\.exe)?$/i
| CommandLine=/(Math_Symbol|math_init)\.js/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, ProcessStartTime, aid])

// HUNT: Bun run from a bun-dl- staging dir, or spawned inside a package-install tree
// MITRE: T1105, T1059.007 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 with parent lineage populated
// TUNING: exclude hosts where Bun is a sanctioned runtime by aid or ComputerName, NOT by
//         dropping the ParentBaseFileName clause. On those hosts rely on Q2 and Q5 instead.
//         The ImageFileName=/bun-dl-/i branch stays in scope everywhere -- no legitimate
//         toolchain executes Bun out of a temporary bun-dl- directory.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^bun(\.exe)?$/i
| (ImageFileName=/bun-dl-/i or ParentBaseFileName=/^(node|npm|npx|yarn|pnpm|sh|bash|zsh|cmd\.exe|powershell\.exe)$/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, aid])

// HUNT: .vscode/tasks.json or .claude/settings.json hook re-launching the loader
// MITRE: T1546, T1204.002 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2; VS Code / Claude Code appear as ParentBaseFileName
// TUNING: a repo that legitimately runs node tasks on folderOpen will NOT reference
//         setup.mjs -- keep both CommandLine clauses. If an internal tooling repo does,
//         exclude that repo's checkout path, not the .vscode/.claude pattern.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^node(\.exe)?$/i
| CommandLine=/setup\.mjs/i
| CommandLine=/\.(vscode|claude)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, ProcessStartTime, aid])

// HUNT: keyv-shai-hulud C2 / exfiltration domain resolved on an endpoint
// MITRE: T1041, T1071.001 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest
// TUNING: none. These four hostnames have no legitimate use; do not exclude anything.
//         The contract rotates domains, so re-check the IOC feed and extend this list.
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(awqhnjewqjkl\.icu|pypi-get\.com|js-mirror\.com|npm-cache\.com)$/i
| table([@timestamp, ComputerName, UserName, DomainName, ContextBaseFileName, aid, aip])

// HUNT: Ethereum RPC dead-drop C2 resolution driven by a Node or Bun process
// MITRE: T1102.001 | CONF: medium  FP: medium  COST: medium
// REQUIRES: DnsRequest with ContextBaseFileName populated
// TUNING: exclude web3 / wallet / blockchain engineering hosts by aid. Do NOT block or
//         alert on the RPC hostnames themselves -- they are legitimate public providers
//         and the malware deliberately chose them for that reason. On excluded hosts,
//         fall back to Q2 and Q5 which carry no such ambiguity.
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/(nodereal\.io|getblock\.io|llamarpc\.com)$/i
| ContextBaseFileName=/^(node|bun)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, DomainName, ContextBaseFileName, aid])

// HUNT: npm publish invoked by an automated Node/Bun parent -- worm republication
// MITRE: T1195.002, T1078, T1080 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 with parent lineage populated
// TUNING: exclude your release pipeline's build agents by aid and its service account by
//         UserName. Keep developer laptops in scope -- a publish from an engineer's
//         machine with a node or bun parent is the exact anomaly this hunts.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(npm|npm\.cmd|node|bun)(\.exe)?$/i
| CommandLine=/\bpublish\b/i
| ParentBaseFileName=/^(node|bun)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])

// HUNT: gh-token-monitor dead-man-switch persistence (systemd user unit / LaunchAgent)
// MITRE: T1546, T1543 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2; pair with the Section 7 launchctl / systemctl checks
// TUNING: none. gh-token-monitor is not shipped by the GitHub CLI or any common tool.
//         ORDER OF OPERATIONS: disable what this finds BEFORE revoking GitHub tokens.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/gh-token-monitor/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ProcessStartTime, aid])

// HUNT: gh auth token harvested by a JavaScript runtime rather than an interactive user
// MITRE: T1552.001, T1528 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with parent lineage populated
// TUNING: exclude your own Node-based gh wrappers by pinning ParentBaseFileName plus the
//         wrapper's aid -- never by removing the ParentBaseFileName clause, which is the
//         only thing separating this from ordinary interactive gh usage.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^gh(\.exe)?$/i
| CommandLine=/auth\s+token/i
| ParentBaseFileName=/^(node|bun)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, aid])

// HUNT: Runner.Worker memory scrape -- privileged Python launched by a JS runtime
// MITRE: T1003, T1552.001 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 on self-hosted Linux GitHub Actions runners
// TUNING: exclude sanctioned setup-python / build steps by matching the CI job's own
//         wrapper aid. Keep node-or-bun parents in scope -- the payload text arrives on
//         stdin, so the process lineage is the only reliable signal here.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(sudo|python3(\.\d+)?|python)$/i
| ParentBaseFileName=/^(node|bun)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])

// HUNT: keyv-shai-hulud known-bad file hashes anywhere in endpoint telemetry
// MITRE: T1195.002 | CONF: medium  FP: low  COST: medium
// REQUIRES: any event carrying SHA256HashData
// FALSE POSITIVES: none -- exact-hash match. Pair with the offline shasum sweep in
//         Section 7.1, which is authoritative for the .mjs / .js text payloads.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ELFFileWritten|ImageHash)$/
| SHA256HashData=/^(9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc|54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668|fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb|927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f|14eb4ce01dd4307759887ff819359b70d7d9ff709ecde039a5abc1aac325b128|3f3f42d072bd36860ab7bd7fb5e10ac0d22c741c13c89505ccd6ec0ea572eea7|29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7|619c56acf572df75b6004a6fc013c80900316a76099b241d64312da3a44f10b4|d584f9b6af48b7ed1f93713944f033783bf149e1c25e1643eb8c0e9df5dc7782)$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData, aid])

Three queries are clean enough to promote to Custom IOAs. The rest stay Investigate-only hunts.

Investigate-only (no alert email; pivot queries only)

Q3, Q6, Q7, Q9, Q10 and Q11 stay as scheduled hunts. Q3, Q6 and Q7 all have legitimate-use overlap that makes an org-wide IOA a noise generator until each environment has baselined its own Bun / web3 / release-pipeline footprint. Q11 is a hash sweep whose right home is Falcon IOC Management (Section 10), not an IOA.

Falcon IOC Management

Import the Section 10 CSV. Set the four C2 domains to detect rather than block-at-DNS if you rely on domain blocking elsewhere — but note the smart contract can rotate the domain list at any time without touching the payload, so domain blocking is a decaying control here. The behavioural IOAs above are the durable ones.

Every atomic value below is traceable to a saved source snapshot in KeyvShaiHulud-npm-Worm-Hunt-sources/. Values that could not be traced to a fetched source do not appear.

type,value,action,severity,expiration,description,tags
domain,awqhnjewqjkl.icu,detect,critical,2027-02-07,keyv-shai-hulud C2 exfil endpoint 443 router,campaign:KeyvShaiHulud
domain,pypi-get.com,detect,critical,2027-02-07,keyv-shai-hulud C2 exfil endpoint 443 router,campaign:KeyvShaiHulud
domain,js-mirror.com,detect,critical,2027-02-07,keyv-shai-hulud C2 exfil endpoint 443 router,campaign:KeyvShaiHulud
domain,npm-cache.com,detect,critical,2027-02-07,keyv-shai-hulud C2 exfil endpoint 443 router,campaign:KeyvShaiHulud
sha256,9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc,prevent,critical,2027-02-07,Stage2 stealer Math_Symbol.js and math_init.js,campaign:KeyvShaiHulud
sha256,54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668,prevent,critical,2027-02-07,Stage1 loader setup.mjs original 29918 bytes,campaign:KeyvShaiHulud
sha256,fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb,prevent,critical,2027-02-07,Stage1 loader setup.mjs worm propagated variant,campaign:KeyvShaiHulud
sha256,927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f,detect,high,2027-02-07,Malicious .vscode/tasks.json folderOpen hook,campaign:KeyvShaiHulud
sha256,14eb4ce01dd4307759887ff819359b70d7d9ff709ecde039a5abc1aac325b128,detect,high,2027-02-07,Malicious .claude/settings.json SessionStart hook,campaign:KeyvShaiHulud
sha256,3f3f42d072bd36860ab7bd7fb5e10ac0d22c741c13c89505ccd6ec0ea572eea7,detect,high,2027-02-07,Injected GitHub workflow leaking toJSON secrets,campaign:KeyvShaiHulud
sha256,29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7,detect,high,2027-02-07,Runner.Worker memory scrape Python,campaign:KeyvShaiHulud
sha256,619c56acf572df75b6004a6fc013c80900316a76099b241d64312da3a44f10b4,detect,high,2027-02-07,gh-token-monitor dead man switch installer,campaign:KeyvShaiHulud
sha256,d584f9b6af48b7ed1f93713944f033783bf149e1c25e1643eb8c0e9df5dc7782,detect,high,2026-11-07,keyv-6.0.0.tgz malicious tarball for registry mirror sweep,campaign:KeyvShaiHulud

# Published by Wiz Research, 2026-08-04.
# Falcon IOC Management takes SHA-256; these are for SHA-1-keyed tooling
# (some registry scanners, SBOM tools and legacy AV consoles).
35a672cf34b996b91f3e1c28cbf3a05a37e036e4  Math_Symbol.js / math_init.js (stage 2)
686aa40d0fc22c8d569494543a0f891f359f2f99  .claude/setup.mjs (IDE-planted loader)
f525d52ceb966516686b482d3dc0137028cc6a63  .vscode/setup.mjs (IDE-planted loader)

# EXECUTION
process: node        cmdline contains: setup.mjs                    -> Q1
process: bun         cmdline contains: Math_Symbol.js | math_init.js -> Q2
process: bun         image path contains: bun-dl-                    -> Q3
process: node        cmdline contains: setup.mjs AND .vscode|.claude -> Q4

# MANIFEST
package.json scripts object replaced entirely with:
  {"preinstall":"node setup.mjs"}
package "files" array gains: setup.mjs, Math_Symbol.js
version bumped by exactly one patch, dist/ byte-identical to prior release

# RUNTIME MARKERS
env var  : _NODE_RUNTIME_INIT=1        (detached-respawn recursion guard)
lock file: tmp.dpkg_14527.lock         (single-instance lock, OS temp dir)
temp dir : bun-dl-*                    (Bun download staging, removed in finally)
user-agent: Bun/1.3.13                 (egress / proxy logs)
signals  : no-op SIGINT and SIGTERM handlers installed

# PERSISTENCE PATHS
.vscode/tasks.json          runOn folderOpen -> node .claude/setup.mjs
.claude/settings.json       SessionStart hook -> node .vscode/setup.mjs
.claude/setup.mjs  .vscode/setup.mjs  .claude/math_init.js
~/.local/bin/gh-token-monitor.sh
~/.config/gh-token-monitor/{token,handler,started_at}
~/.config/systemd/user/gh-token-monitor.service
~/Library/LaunchAgents/com.user.gh-token-monitor.plist
/tmp/gh-token-monitor.out.log  /tmp/gh-token-monitor.err.log

# C2 / DEAD DROP
eth contract : 0xE1f2395ee43e45A1556EC6438a88c31B83493103  (StringListStore)
eth selector : 0x53ed5143   block: latest   timeout: 3s per RPC
C2 health check: HTTPS GET /router on 443; only HTTP 400 or 404 = healthy
fallback: GitHub commit search "thebeautifulmarchoftime " (TRAILING SPACE)
parser accepts marker: thebeautifulsnadsoftime
token relay marker: IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients
exfil repo description: Shai-Hulud: Here We Go Again
infection commit message: chore: update config   (author identity: claude)

# The 11 confirmed maintainer-linked malicious releases (Snyk, 2026-08-04).
# The starred three are the ones that install SILENTLY inside live caret ranges.
#   keyv@6.0.0                    (blocked by every normal caret range)
# * cacheable-request@13.0.20
# * cache-manager@7.2.10
# * @cacheable/utils@2.5.1
#   flat-cache@6.1.24   file-entry-cache@11.1.6   cacheable@2.5.1
#   @cacheable/memory@2.2.1   @cacheable/net@2.1.1
#   @cacheable/node-cache@3.1.2   ecto@5.0.1
# Beyond these, ~434-444 further packages across ~1381 versions were worm-infected.
# A fixed list is a LOWER BOUND. Hunt behaviour and hashes, not names.

# Known-clean pins verified to have no install lifecycle hook:
{
  "overrides": {
    "keyv": "5.6.0",
    "flat-cache": "6.1.23",
    "file-entry-cache": "11.1.5",
    "cacheable-request": "13.0.19",
    "cacheable": "2.5.0",
    "@cacheable/utils": "2.5.0",
    "cache-manager": "7.2.9",
    "@cacheable/net": "2.1.0",
    "@cacheable/node-cache": "3.1.1",
    "@cacheable/memory": "2.2.0",
    "ecto": "5.0.0"
  }
}

Deliberately not in the import CSV: the resolved IP addresses in Section 4. Two are Cloudflare shared edge and one is an AWS-hosted public Ethereum RPC provider — blocking any of them causes collateral outage and catches nothing durable. They are recorded as enrich context only. The three Ethereum RPC hostnames are likewise excluded: they are legitimate public infrastructure that the malware chose because blocking them is impractical.

PB-1 · Disable npm lifecycle scripts fleet-wide (implements H1)

Prerequisites: inventory of packages in your estate that legitimately require install scripts (native modules such as node-gyp builds, puppeteer, esbuild, sharp). Pilot on one team for a week — a missing install script fails loudly at build time, not silently. Reboot required: no. Rollback: npm config delete ignore-scripts on each host and remove the CI environment variable; for the repo-level file, git revert the .npmrc commit. Rollback restores the previous behaviour immediately with no reboot and no state left behind.

# 1. Per-repository (checked in, applies to everyone who builds the repo)
cat >> .npmrc <<'EOF'
ignore-scripts=true
EOF

# 2. Per-developer machine (user-level default)
npm config set ignore-scripts true --location=user

# 3. CI: environment variable beats config file and cannot be locally overridden
#    GitHub Actions -- add at workflow or org level
#      env:
#        NPM_CONFIG_IGNORE_SCRIPTS: "true"
#    Generic shell runner:
export NPM_CONFIG_IGNORE_SCRIPTS=true

# 4. Narrow allowlist for packages that genuinely need install scripts.
#    Run the general install with scripts off, then rebuild only what is allowed.
npm ci --ignore-scripts
npm rebuild esbuild sharp   # replace with YOUR verified allowlist

# 5. Verify on every host
npm --version                 # 12 or newer already defaults to not running scripts
npm config get ignore-scripts # must print: true
node -e 'console.log(process.env.NPM_CONFIG_IGNORE_SCRIPTS)'

PB-2 · Eradicate the payload and IDE persistence from a suspected host (implements H3, H4)

Prerequisites: host isolated from the network (Falcon Network Contain or equivalent); forensic copies of ~/.npm, shell history and any gh-token-monitor artifacts taken before deletion; IR lead has approved the token-revocation sequence. Reboot required: yes, after step 4, to guarantee no detached Bun process survives. Rollback: none required for steps 1–3 — they remove attacker-planted artifacts that have no legitimate function, and the forensic copies taken in the prerequisites are the recovery path if a file turns out to be legitimate. For step 4, re-enabling a disabled unit is systemctl --user enable gh-token-monitor.service / launchctl load, but you should not need it: gh-token-monitor is not a component of any legitimate tool.

# RUN IN ORDER. Do not revoke GitHub tokens until step 4 is complete.

# 1. Preserve evidence FIRST
mkdir -p /var/tmp/ir-keyv && cd /var/tmp/ir-keyv
cp -a ~/.config/gh-token-monitor . 2>/dev/null
cp -a ~/.local/bin/gh-token-monitor.sh . 2>/dev/null
cp -a /tmp/gh-token-monitor.*.log . 2>/dev/null
ps -eo pid,ppid,user,etime,command | grep -Ei 'bun|setup\.mjs|math_init|Math_Symbol' > ps.txt

# 2. Kill live payload processes
pkill -f 'Math_Symbol\.js' ; pkill -f 'math_init\.js' ; pkill -f 'setup\.mjs'
rm -f "${TMPDIR:-/tmp}"/tmp.dpkg_14527.lock
rm -rf "${TMPDIR:-/tmp}"/bun-dl-*

# 3. Remove npm-delivered payload and rebuild the tree clean
rm -rf node_modules
npm cache clean --force
# apply the Section 10 overrides block to package.json first, then:
npm install --package-lock-only --ignore-scripts
npm ci --ignore-scripts

# 4. Disable the dead-man switch BEFORE any token revocation
systemctl --user disable --now gh-token-monitor.service 2>/dev/null
launchctl unload ~/Library/LaunchAgents/com.user.gh-token-monitor.plist 2>/dev/null
rm -f ~/Library/LaunchAgents/com.user.gh-token-monitor.plist \
      ~/.config/systemd/user/gh-token-monitor.service \
      ~/.local/bin/gh-token-monitor.sh
rm -rf ~/.config/gh-token-monitor

# 5. Strip IDE / coding-agent persistence from EVERY local checkout.
#    Review each hit before deleting -- some repos have legitimate .vscode tasks.
find "$HOME" -type f \( -path '*/.vscode/tasks.json' -o -path '*/.claude/settings.json' \) \
  -exec grep -lE 'setup\.mjs|math_init' {} + 2>/dev/null
find "$HOME" -type f \( -path '*/.claude/setup.mjs' -o -path '*/.vscode/setup.mjs' \
     -o -path '*/.claude/math_init.js' \) -print 2>/dev/null

# 6. Reboot, then re-run the Section 7.1 sweep to confirm the host is clean.

PB-3 · Lock down GitHub and npm tokens (implements H7)

Prerequisites: completed PB-2 step 4 on every affected host — revoking before the dead-man switch is disabled is the trigger condition. A clean workstation for issuing replacement credentials. Change window agreed with any team whose release pipeline uses the tokens being rotated. Reboot required: no. Rollback: none required — revoked credentials cannot be un-revoked, and that is the intent. The recovery path is issuing replacements, so the safeguard is sequencing (replacement issued and validated before the old credential is revoked) rather than an undo step. Keep the old token's ID recorded so audit-log correlation still works afterwards.

# --- npm: find and kill 2FA-bypass publish tokens (the propagation prerequisite)
npm token list
# Revoke every token with bypass_2fa true or with unnecessary package-write:
npm token revoke <token-id>
# Reissue as granular, package-scoped, 2FA-enforced, short expiry.

# --- GitHub: inventory then revoke
gh auth status
gh api /user | jq '.login'
# Classic PATs and OAuth tokens (ghp_ / gho_) are the ones the payload targets,
# plus App installation tokens (ghs_) used for the branch-infection path.
# Revoke via Settings > Developer settings > Personal access tokens.

# Org policy: block new classic PATs, require fine-grained tokens
gh api -X PUT /orgs/<org>/personal-access-token-requests \
  -f 'personal_access_token_requests_enabled=false' 2>/dev/null || \
  echo "Set this in Org Settings > Personal access tokens instead"

# --- Audit for the workflow-injection artifacts before you close the incident
gh api "/repos/<org>/<repo>/branches" --paginate \
  | jq -r '.[].name' | grep -i 'dependabot/github_actions/format/setup-formatter'
gh api "/repos/<org>/<repo>/actions/artifacts" \
  | jq -r '.artifacts[] | select(.name=="format-results.txt") | .created_at'

# --- Cloud: rotate anything the affected host or runner could reach
aws iam list-access-keys --user-name <user>
aws iam update-access-key --access-key-id <id> --status Inactive --user-name <user>
# Rotate Secrets Manager and SSM SecureString values that were readable from the
# compromised identity -- the collector decrypts, it does not merely enumerate.

PB-4 · Fleet-wide exposure sweep (implements H2, H12)

Prerequisites: read access to all source repositories and the ability to run a scripted checkout. Run from a clean host. Reboot required: no. Rollback: none required — this playbook is read-only. It clones, greps and reports; it modifies no repository and installs nothing.

#!/usr/bin/env bash
# Read-only exposure sweep across every repo in an org. Modifies nothing.
set -uo pipefail
ORG="${1:?usage: sweep.sh ORG}"
OUT="keyv-exposure-$(date +%Y%m%d).txt"
: > "$OUT"

gh repo list "$ORG" --limit 1000 --json nameWithOwner -q '.[].nameWithOwner' |
while read -r REPO; do
  TMP=$(mktemp -d)
  gh repo clone "$REPO" "$TMP/r" -- --depth 1 --quiet 2>/dev/null || { rm -rf "$TMP"; continue; }

  # a) lockfile hits on the three that install SILENTLY inside caret ranges
  grep -REn 'cacheable-request.{0,12}13\.0\.20|cache-manager.{0,12}7\.2\.10|@cacheable/utils.{0,12}2\.5\.1' \
    "$TMP/r"/{package-lock.json,pnpm-lock.yaml,yarn.lock,npm-shrinkwrap.json} 2>/dev/null |
    sed "s|^|$REPO LOCKFILE |" >> "$OUT"

  # b) the lifecycle hook itself, anywhere in the repo
  grep -REn '"preinstall"[[:space:]]*:[[:space:]]*"node setup\.mjs"' "$TMP/r" 2>/dev/null |
    sed "s|^|$REPO PREINSTALL |" >> "$OUT"

  # c) IDE / coding-agent persistence
  for P in .vscode/tasks.json .claude/settings.json .claude/setup.mjs \
           .vscode/setup.mjs .claude/math_init.js; do
    [ -e "$TMP/r/$P" ] && echo "$REPO IDEHOOK $P" >> "$OUT"
  done

  # d) the injected secret-leaking workflow
  grep -REln 'toJSON\(secrets\)' "$TMP/r/.github/workflows" 2>/dev/null |
    sed "s|^|$REPO WORKFLOW |" >> "$OUT"

  rm -rf "$TMP"
done

echo "--- summary ---"; sort "$OUT" | uniq -c | sort -rn | head -40

Sequencing is the whole runbook. P2 must complete before P4. The dead-man switch fires on token revocation, so rotating credentials before locating and disabling gh-token-monitor hands the operator a trigger at the exact moment you are trying to lock them out.

Validation status. Eleven CQL queries cover ten of the fourteen mapped attack-chain steps. Four steps (maintainer account takeover, provenance signing, C2-delivered eval(), and GitHub branch infection) have no endpoint telemetry by nature and are addressed through audit-log hunts in Section 7 and policy controls in Section 12 rather than detections. Overall pack confidence is high: four independent vendor analyses agree on the payload mechanics, and every atomic indicator traces to a saved source snapshot. Before deploying, complete Section 11 gates 1 and 2 — gate 1 because a zero-hit result is worthless without confirmed dev/CI sensor coverage, and gate 2 because Q3, Q6, Q7 and Q9 will alert-storm in any environment that legitimately uses Bun, web3 RPC, or Node-wrapped gh.

Source integrity note. All six sources were fetched as plain text on 2026-08-07 and saved verbatim to KeyvShaiHulud-npm-Worm-Hunt-sources/. Each was reviewed for embedded instructions or out-of-band indicator delivery; none was found, and no source attempted to direct tooling behaviour. Every atomic indicator in Sections 4 and 10 is mechanically traceable to at least one of those snapshots.