Keyv npm Worm Poisons Hundreds of Downstream Packages

Deep Technical Analysis of the Shai-Hulud Worm

The Shai-Hulud malware campaign executes a highly sophisticated, multi-stage attack chain designed to harvest critical infrastructure secrets, maintain persistent access in developer environments, and spread laterally to other software packages. To fully secure an enterprise environment, security engineers must understand the exact technical execution of this supply chain threat.

Stage 1: The Dropper and Execution Hook

The entry point for this attack relies on a compromised maintainer account pushing malicious updates to npm. In every poisoned package, the attacker inserted two files: setup.mjs and Math_Symbol.js. The attacker also modified the package.json configuration file, adding a preinstall hook that automatically runs the setup script: node setup.mjs. When a developer or a continuous integration pipeline executes an installation command, the system automatically triggers the execution of the obfuscated setup.mjs dropper prior to package resolution.

Stage 2: Evading Node.js Monitoring via Bun Runtime

The primary role of the setup.mjs dropper is to establish a secure runtime execution environment that bypasses standard Node.js monitoring, behavioral endpoint analysis, and static inspection tools. To achieve this, the dropper queries the host for the Bun JavaScript runtime. If Bun is absent, the script silently downloads a standalone Bun binary from its official release repository on GitHub. Once downloaded, the script uses the native process execution command to spawn the secondary payload, Math_Symbol.js, within the Bun environment. Running the payload through Bun allows the malware to execute advanced system calls and hide its footprint from standard Node.js security hooks.

Stage 3: Comprehensive Credential Harvesting and Memory Dumping

The core payload, contained within the heavily obfuscated 728 KB Math_Symbol.js file, implements a series of aggressive credential extractors tailored for different storage layers:

• npm Registry Tokens: The malware reads the local .npmrc configuration file at the user home directory and scans the active workspace for other instances. It extracts the auth tokens and verifies them live against the official npm registry registry.npmjs.org to ensure they are active before exfiltration.

• GitHub Access Tokens: The payload searches for classic personal access tokens, OAuth tokens, GitHub App server-to-server tokens, and JSON Web Token OpenID Connect tokens. It extracts these credentials from configuration files like hosts.yml, active environment variables, and direct filesystem searches. On GitHub Actions runners, the payload goes a step further by executing a specialized command to dump the worker runner process memory directly, harvesting the active actions token and URL.

• Cloud Provider Infrastructure Secrets: The scanner targets AWS credentials in config and credentials files, harvesting active profiles. It attempts to query the local EC2 Instance Metadata Service using IMDSv2 and falls back to IMDSv1 if needed. It also checks ECS container metadata endpoints and attempts to enumerate AWS Secrets Manager secrets across multiple cloud regions.

• Kubernetes and HashiCorp Vault Keys: The script attempts to read the service account token, certificate authority file, and namespace directly from the default service account directory. It uses these stolen tokens to query the Kubernetes API for active secrets. Additionally, the malware scans environment variables, configuration files, and container paths for Vault tokens, subsequently enumerating and reading all accessible key-value secret stores.

• Generic Workspace Scans: Using over 200 platform-aware glob patterns, the scanner hunts for environment files, private keys (such as PEM and SSH keys), Terraform state files, Docker registry configurations, KeePass databases, and virtual private network profiles.

Stage 4: Modern Developer Tool Persistence Hooks

A unique aspect of the Shai-Hulud campaign is its focus on modern engineering tools. The payload specifically targets development workspace configuration directories to ensure persistent execution:

• Visual Studio Code Exploitation: The malware modifies the local workspace configuration, writing a malicious execution task inside the tasks.json file in the VS Code folder. This task is configured to execute automatically when the workspace folder is opened by a developer, creating silent local persistence.

• Claude Code Integration: The malware writes configuration files directly to the settings directory of local Claude Code setups and drops a secondary copy of the script in the local directory. This targets active AI coding assistants, triggering code execution during automated context-building or routine refactoring tasks.

Stage 5: Worm-Like Self-Propagation and Lateral Spread

If the harvested npm tokens possess publishing permissions, the malware initiates its worm-like distribution mechanism. It automatically identifies all packages owned or maintained by the compromised user identity, injects the malicious preinstall hooks and scripts into their codebases, and publishes a new patch version to the public registry. This automated propagation cycle is responsible for the rapid spread of the worm to hundreds of downstream packages within hours of the initial breach.

Enterprise Cyber Risk and GCC Compliance Implications

For organizations operating across the Gulf Cooperation Council (GCC) region, the risk of a software supply chain compromise is severe. Businesses in Dubai, Riyadh, and Doha are rapidly advancing their digital services, heavily relying on automated cloud-native pipelines, containerized environments, and external open-source libraries. A single developer installing a compromised dependency like keyv can expose the entire enterprise infrastructure to unauthorized entry.

The exfiltrated credentials, including AWS keys, Kubernetes secrets, and Vault tokens, give threat actors immediate access to critical production environments, private databases, and continuous integration pipelines. This exposure poses a major threat to corporate compliance frameworks. Organizations seeking alignment with national regulatory standards, PCI-DSS, or SOC 2 must establish strict validation processes to ensure malicious dependencies are blocked before they reach production networks.

If your organization utilizes automated deployment pipelines, verifying your external packages is critical. Enterprise entities must proactively analyze their application codebases. Engaging a professional team for a thorough Source Code Review can identify hidden lifecycle scripts, hardcoded secrets, and backdoored dependencies in your primary repositories.

Advanced Detection, Containment, and Incident Response Playbook

Containing a Shai-Hulud infection requires strict operational coordination due to a destructive defense mechanism integrated by the threat actors: a local dead-man's switch. The malware installs a background watcher process that continuously monitors the validation state of the stolen API keys and tokens. If an incident response team immediately revokes a compromised token without cleaning the local development endpoint first, the watcher process detects the revocation and triggers a local destructive command, wiping the entire workspace and local files.

To safely isolate and contain this threat, security teams must follow a structured response playbook:

Step 1: Host Isolation

Immediately disconnect any suspected developer workstation, virtual desktop, or continuous integration runner from the local network. Do not execute credential revocation commands globally until the physical or virtual host has been fully isolated from the internet to block any outbound exfiltration or monitoring checks.

Step 2: Terminate the Watcher and Purge Malicious Hooks

Inspect active running processes on the isolated machine to locate and terminate any unauthorized background execution tasks checking token validation states. Search for and delete malicious configurations in the workspace settings, specifically auditing the VS Code tasks and Claude Code configurations. Remove the setup.mjs, Math_Symbol.js, and math_init.js files from all directories.

Step 3: Secure External Credential Rotation

Once the local host is completely cleaned and isolated, execute a comprehensive rotation of all potentially exposed credentials from a separate, secure administration workstation. This includes rotating AWS access keys, GitHub personal access tokens, npm publishing keys, Kubernetes configurations, and Vault access tokens.

Step 4: Restrict Local Script Execution

To prevent future occurrences similar supply chain attacks, enforce policies to ignore package lifecycle scripts during installations. Configure your package manager to disable script execution globally on developer systems and build runners. This simple configuration prevents malicious preinstall hooks from executing automatically during installation workflows.

Additionally, keeping an up-to-date map of your external-facing systems and software assets is crucial. Organizations should employ continuous Attack Surface Management to monitor exposed endpoints and identify vulnerable deployment servers before attackers can exploit them.

Proactive Supply Chain Defense

Supply chain attacks demonstrate how vulnerable modern development environments are to lateral compromises. Securing an enterprise software pipeline requires continuous vigilance, strict access controls, and regular offensive testing. Implementing automated build validation and restricting script execution are critical first steps, but organizations must also look for broader indicators of digital exposure.

For deep, continuous validation of your software assets and infrastructure, contact Femto Security today. Our expert offensive security teams deliver tailored solutions to secure your enterprise pipelines and protect your organization from complex supply chain threats.