Glossary term
Supply chain attack
A supply chain attack reaches its target by exploiting weaknesses in the products or services the target depends on.
Read more
Significant cyber incident
Keyv npm maintainer account takeover
In early August 2026, attackers took over the GitHub account of a maintainer of Keyv, a widely used JavaScript caching library, and pushed malware into its npm packages.
In short
In early August 2026, attackers took over the GitHub account of a maintainer of Keyv, a widely used JavaScript caching library, and pushed malware into its npm packages. CERT-EU says the self-spreading malware, called ChainDrop, stole developer and build credentials and used them to reach more maintainers. CERT-EU says at least hundreds of packages and over 2 billion monthly installs were exposed. It matters because one trusted maintainer account became a path into many downstream software projects.
What happened
On 4 August 2026, malicious versions of Keyv and related caching packages appeared on npm. GitHub published malware advisories the same day for keyv 6.0.0, cacheable 2.5.1 and flat-cache 6.1.24. CERT-EU says a Keyv maintainer’s GitHub account was taken over.
CERT-EU says the malware, called ChainDrop and based on Shai-Hulud, steals credentials from developer and build environments and uses them to spread to more maintainers. It reports at least hundreds of packages and over 2 billion monthly installs exposed.
The maintainer reported a recovery on 5 August 2026: machines wiped, publishing paths disabled, bad versions removed with npm, and branches reset.
Timeline
-
2025-09-23
CISA publishes an alert on the earlier Shai-Hulud npm worm, which had compromised over 500 packages.
-
2026-08-04 10:43 UTC
GitHub publishes a malware advisory for flat-cache 6.1.24.
-
2026-08-04 11:19 UTC
GitHub publishes a malware advisory for keyv 6.0.0.
-
2026-08-04 11:28 UTC
GitHub publishes a malware advisory for cacheable 2.5.1.
-
2026-08-04 22:32 UTC
A public issue "[URGENT] Repository and package compromised" is opened on the Keyv repository.
-
2026-08-05 04:10 UTC
The maintainer says a full audit is under way.
-
2026-08-05 22:38 UTC
The maintainer reports recovery steps: machines wiped, Actions and trusted publishing disabled, bad versions removed with npm, branches reset.
-
2026-09-03
CERT-EU's August 2026 Cyber Brief summarizes the campaign.
How the attack worked
Account takeover
CERT-EU says a Keyv maintainer’s GitHub account was taken over and used to distribute malicious npm packages. The sources opened do not say how the account was taken over.
Malicious packages
GitHub flagged keyv 6.0.0, cacheable 2.5.1 and flat-cache 6.1.24 as malware. The maintainer names setup.mjs and Math_Symbol.js among the payload files, and says malicious branches, tags and release commits had to be removed.
Credential theft and spread
CERT-EU says the malware steals credentials from developer and CI/CD environments and uses them to spread to additional maintainers. GitHub’s advisories say any computer that installed an affected version should be treated as fully compromised.
Link to earlier worm
CERT-EU describes ChainDrop as Shai-Hulud-based. CISA warned about the original Shai-Hulud worm in September 2025.
Who says who was behind it
No public attribution. CERT-EU classes the activity as opportunistic and names the malware ChainDrop (Shai-Hulud-based), but names no actor. The sources opened do not say how the maintainer account was taken over.
Impact
CERT-EU: at least hundreds of packages and over 2 billion monthly installs exposed, with organizations globally affected.
GitHub advisories: three packages flagged (keyv 6.0.0, cacheable 2.5.1, flat-cache 6.1.24). Any computer that installed them should be treated as fully compromised and its secrets rotated.
The maintainer states the supported safe versions are 5.6.0 and 6.0.0-rc.1.
No official source opened gives a count of victims or losses.
Government and regulator response
- 4 August 2026: GitHub published malware advisories for keyv, cacheable and flat-cache. They tell users to rotate all secrets from a different computer.
- 5 August 2026: the Keyv maintainer reported wiping affected machines, disabling GitHub Actions and npm trusted publishing, working with npm to remove bad versions, deleting malicious branches and tags, and force-resetting main, v4 and v5.
- 5 August 2026: the maintainer said GitHub would be asked to purge cached data for the malicious commits, and that a broader audit continues.
- 3 September 2026: CERT-EU included the incident in its August Cyber Brief.
Lessons
-
One account can reach many projects
CERT-EU says a single maintainer account takeover led to hundreds of exposed packages.
-
Stolen credentials feed the next wave
The malware steals developer and CI/CD credentials and uses them to reach more maintainers.
-
Treat installs as compromises
GitHub advises treating any computer with an affected version as fully compromised and rotating its secrets.
-
Cleanup is more than removing versions
The maintainer also had to reset branches, delete tags and ask GitHub to purge cached commits.
-
Controls can fall short
The maintainer said a package age control they believed was in place did not prevent the incident.
-
The threat repeats
CISA warned of the original Shai-Hulud worm in September 2025, and this wave builds on it.
What to check in your own organization
-
Find affected versions
Search lockfiles and build logs for keyv 6.0.0, cacheable 2.5.1 and flat-cache 6.1.24, and for other packages named in advisories.
-
Rotate secrets
If an affected version ran anywhere, rotate npm, GitHub, cloud and CI secrets from a different, clean computer.
-
Pin dependencies
Pin versions to known safe releases, as CISA advised for the earlier worm.
-
Protect maintainer accounts
Require phishing-resistant multifactor authentication on GitHub and npm accounts.
-
Limit publishing rights
Review who and what can publish packages, and keep workflow permissions read-only where possible.
-
Review developer machines
Treat workstations and build runners that installed a bad version as compromised and rebuild them.
-
Early warning
Threat intelligence monitoring can watch for exposed credentials and for compromised packages named in advisories such as those GitHub issued within hours. This can shorten the time before you learn that a dependency is affected. It does not prevent an attack.
Where it happened
Questions
What happened?
CERT-EU says a Keyv maintainer's GitHub account was taken over and malware spread through npm packages from 4 August 2026.
Which versions are affected?
GitHub flagged keyv 6.0.0, cacheable 2.5.1 and flat-cache 6.1.24. CERT-EU says hundreds of packages were exposed in total.
Which versions are safe?
The maintainer says the supported safe versions are 5.6.0 and 6.0.0-rc.1.
What should I do if I installed one?
GitHub says to treat the computer as fully compromised and rotate all secrets from a different computer.
Who is behind it?
No public attribution. CERT-EU names the malware ChainDrop, based on Shai-Hulud.
How many installs were exposed?
CERT-EU says over 2 billion monthly installs were exposed.
In our research
- Supply chain attack Glossary term
Sources
- CERT-EU Cyber Brief 26-09, August 2026 CERT-EU
- [URGENT] Repository and package compromised (issue 2051 and maintainer comments) Keyv project on GitHub
- Malware in keyv (GHSA-3p9h-f68w-m6fx) GitHub Advisory Database
- Malware in cacheable (GHSA-jpjx-r3gh-v5pf) GitHub Advisory Database
- Malware in flat-cache (GHSA-8jxr-wprf-45g8) GitHub Advisory Database
- Widespread Supply Chain Compromise Impacting npm Ecosystem CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.