Mini Shai-Hulud Hits keyv: Trojanized Release Exfiltrates CI Secrets via GitHub
Brief
On August 4, 2026, a malicious version of keyv was published to npm as keyv@6.
- 0 , one of a number of npm packages affected across the Keyv and Cacheable ecosystem. The release follows the Mini Shai-Hulud pattern: a trojanized version of a heavily depended-on package, with an install-time hook that reaches cloud and CI credentials.
It leaves the compiled library untouched and instead adds a preinstall hook and two files. The second of those files carries names and endpoints for AWS, HashiCorp Vault, Kubernetes, Google Cloud, Azure, npm, and GitHub Actions credentials, batched collection, and repository creation through GitHub’s own API.
Technical analysis
npm install └─ preinstall hook in package. json └─ setup. mjs └─ Math_Symbol. js, run under a downloaded Bun runtime Figure 1: The entry path, from a dependency install to the bundled file.
What changed
keyv@6. 0.