Shai-Hulud worm hijacks keyv + 400 npm packages, hunts AI keys
It fires when you open a poisoned repo in Claude Code or VS Code — no npm install needed — and it's harvesting Claude, OpenAI and Cursor keys too.
Copy markdown
keyv, cacheable and 400+ packages, 2B installs a month
A compromised maintainer account pushed poisoned keyv (~604M monthly downloads), flat-cache, cacheable-request and hundreds more on Aug 4. Aikido counts ~434 packages across 1,381 versions with 2B+ combined monthly installs — if any sit in your tree, treat the machine as compromised.
The new trick: it runs where no scanner looks
The payload plants a SessionStart hook in .claude/settings.json and a folderOpen task in .vscode/tasks.json. It fires the moment you open the repo in Claude Code or VS Code — no npm install required — and dependency scanners never read those files.
It now hunts your AI keys
Beyond npm, GitHub, AWS, Kubernetes and Vault tokens, this wave specifically harvests credentials for Claude, OpenAI, Codex, Cursor and Gemini — expanding its target list by roughly 70%. Your model API keys are now first-class loot.
C2 lives on an Ethereum smart contract
The worm reads its command-and-control domains from a StringListStore contract via eth_call, so operators swap infrastructure without shipping new malware. Blocking the single exfil domain (npm-cache[.]com) won't stop it.
Your first hour: rotate everything
Run npm audit, purge affected versions from dev and CI, and within 15 minutes rotate npm, GitHub, AWS and Kubernetes tokens. Then grep repos for .claude/setup.mjs, .vscode/setup.mjs and 'chore: update config' commits authored by 'claude'.
Even npm 12's hook blocking won't save you
npm 12+ blocks unapproved preinstall scripts by default, but this vector skips install entirely — it runs on the folder-open trust your editor already grants. Researchers expect the next wave to target MCP server definitions and agent rule files.