The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one

An attacker on Tuesday took over the GitHub account of the developer who maintains keyv , a small key-value storage library that npm serves roughly 127 million times a week. Within hours, poisoned versions of keyv and its sibling caching packages were live on npm, carrying a credential-stealing worm. By midday, security firm Aikido counted at least 868 compromised packages across 1,381 versions, together carrying over two billion monthly installs, a total still climbing. JFrog independently traced the campaign across more than 400 packages and 1,700 poisoned versions. The part that should worry every security team is not the download count. It is the paperwork. The initial poisoned releases shipped with valid provenance signatures, the cryptographic attestation the industry built to prove a package came from where it claims. The worm did not forge that signature. It earned it, the way a legitimate release would. A day earlier, CrowdStrike published its 2026 Threat Hunting Report and pr

This report comes from VentureBeat. The story centres on The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one. Full coverage and background context is available at the original source. Readers seeking more detail on this developing topic are encouraged to follow updates from VentureBeat and related outlets covering this beat.