At 09:02 UTC on August 4, 2026, an attacker using the compromised GitHub identity of maintainer Jared Wray pushed a malicious commit directly to the main branch of the keyv repository; IDE and agent persistence hooks landed at 09:04, a cleanup commit removed a telltale test file at 09:23, and a trojanized keyv@6.0.0 was published to npm at 09:35, with the broader cacheable family following between 10:09 and 10:28. By the time security researchers at Aikido, SafeDep, Socket, and Wiz filed takedown requests, more than 420 distinct package names carrying over two billion combined monthly installs had been poisoned. The same maintainer owns cacheable (29 million downloads per month), flat-cache (565 million downloads per month), and file-entry-cache (557 million downloads per month), all of which were swept into the same attack.
For the first time in any documented supply chain attack, the worm planted persistence hooks directly inside AI coding-agent configurations: specifically, inside the.claude/settings.json file used by Claude Code and the.vscode/tasks.json task runner used by Visual Studio Code. The attacker committed those VS Code and Claude Code hook files to the source repository itself, meaning that simply opening a checkout could run the same payload without any npm install. The poisoned tarballs simultaneously carried valid npm provenance signed by GitHub Actions, so every cryptographic integrity check passed. Command-and-control infrastructure was retrieved dynamically from an Ethereum smart contract at address 0xE1f2395ee43e45A1556EC6438a88c31B83493103, allowing the attacker to rotate domains without touching the payload.
The credential harvest targeted AI-agent stores for Claude, OpenAI, Codex, Cursor, and Gemini; cryptocurrency keystores including Foundry, Solana, and Monero key material; and system files including /etc/shadow, with all collected data committed to attacker-created GitHub repositories labeled "Shai-Hulud: Here We Go Again." A dead-man's switch executed attacker-supplied code the moment any stolen token was revoked, inverting standard incident-response procedure: security teams that rotated credentials first triggered the trap. Kodem Security catalogued this as the sixth major wave of the Shai-Hulud lineage, tracing its ancestry through the original September 2025 npm campaign, Shai-Hulud 2.0, The Golden Path, an SAP package compromise, and the Miasma variant against Red Hat's @redhat-cloud-services namespace in June 2026.
Wiz attributes the payload to the Mini Shai-Hulud family, with similarities to the earlier TeamPCP and @antv campaigns, though no confirmed attribution has been established and copycat activity is considered likely. Researchers are careful to note this is not a vulnerability in Claude Code or VS Code; it is, however, a stark demonstration that as AI coding agents become standard developer tooling, they simultaneously become a new and under-defended attack surface. Coding assistants like Claude Code and VS Code with Copilot operate with elevated trust in developer environments precisely because their utility depends on it, and skeptics of broad remediation guidance argue that workspace-trust prompts have never functioned as a meaningful security boundary in practice.
Any developer whose machine ran npm install against the keyv or cacheable families on August 4 should disable the worm's dead-man's switch before rotating a single credential, not after.