If your software engineering or DevSecOps teams rely on automated continuous integration (CI/CD) pipelines to build NodeJS software, freeze your dependency deployment scripts immediately. Security threat analysts from Microsoft Security Intelligence and Socket Security have uncovered a devastating new npm supply chain attack that turns trusted software dependencies into automated credential execution pipelines.
The campaign achieved devastating reach because attackers targeted the core maintainer infrastructure behind Keyv, a foundational key-value storage dependency generating tens of millions of weekly downloads across global enterprise repositories. Once adversaries gained administrative publishing access to the authentic developer account, they deployed altered software releases formatted to resemble ordinary routine bug patches.
Unlike simplistic one-off dependency poisoning attacks, the Mini Shai-Hulud malware is engineered for worm-like self-propagation across developer networks:
- Preinstall Execution: When a developer or automated cloud pipeline pulls a compromised package version (such as
keyv@6.0.0), a malicious preinstall hook inside thepackage.jsonmanifest executes an obfuscated script labeledsetup.mjs. - Secret Skimming & Harvest: The embedded payload launches credential-stealing scripts (
Math_Symbol.jsandMath_Init.js) to comb local environment variables, workspace configurations, and operating system keychains for programmatic access secrets. - Automated Self-Propagation: The malware hunts for active npm publishing tokens, GitHub deployment keys, and cloud infrastructure secrets (AWS, Azure). Once exfiltrated to adversary servers, these stolen tokens are automatically weaponized to hijack the victim's own maintained npm repositories.
This self-replicating loop explains why defensive monitoring engines recorded 2,234 compromised package artifacts across 444 unique software repositories within hours of initial detonation.
| IoC Threat Type | Verified Indicator / Artifact | Technical Context & Impact Description |
|---|---|---|
| Compromised npm Package | keyv@6.0.0 |
Confirmed malicious Keyv release triggering automated dropper preinstall hook |
| Compromised npm Package | file-entry-cache@11.1.6 |
Poisoned caching utility actively stealing publishing credentials |
| Compromised npm Package | cache-manager@7.2.10 |
Malicious version injection within global application cache controller |
| Compromised npm Package | cacheable-request@13.0.20 |
Affected HTTP request wrapper utilized across downstream web builds |
| Compromised npm Package | qlik/api@2.14.2 |
Targeted analytics API wrapper compromised during secondary propagation |
| Affected Package Scope | servicetitan/* (17+ packages) |
Includes compromised eslint-config, anvil-themes, table, and log-service |
| Malicious Execution Files | setup.mjs | Math_Symbol.js | Math_Init.js |
Obfuscated JavaScript loader and automated token-exfiltration payloads |
| EDR Detection Signature | Trojan:npm/MalBun.A |
Official Microsoft Defender for Endpoint behavioral detection confirmation |
To view mandatory dependency pinning commands (--ignore-scripts deployment workflows), cryptographic token rotation protocols, and comprehensive SHA-512 integrity verification architectures, read our official executive advisory here:
👉 Read the Full Official CyberUpdates365 Advisory: New npm Supply Chain Attack & Keyv Malware Fix Guide
Technical threat intelligence report audited and verified by the CyberUpdates365 Threat Intelligence Unit in accordance with NIST & CISA Open Source Security frameworks (August 2026).