# The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign

DevFeed: [The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign](<https://devfeed.tech/articles/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign-13261.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign>)

Published: 2026-08-04T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Ethereum](<https://devfeed.tech/topics/ethereum.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [ethereum](<https://devfeed.tech/tags/ethereum.md>), [github](<https://devfeed.tech/tags/github.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [payload](<https://devfeed.tech/tags/payload.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [smart-contract](<https://devfeed.tech/tags/smart-contract.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

## AI overview

The article examines a 2026 npm supply-chain attack in which a compromised maintainer account was used to publish malicious versions of keyv and cacheable-related packages. It reports credential theft, worm-like propagation to hundreds of downstream packages, and command-and-control infrastructure discovered through an Ethereum smart contract. It also explains that Chainguard customers were protected by malware scanning and package cooldowns.

## Source excerpt

The latest npm supply chain attack hit keyv and cacheable. See how Chainguard's malware scanning and cooldowns kept customers protected.