Here's another active npm supply chain attack, and this one's spreading fast.
Shai-Hulud - named after the giant sandworms from Dune, because apparently threat actors have a flair for drama - has compromised Keyv and a long list of TanStack packages. The attack was discovered in late June 2025, and if you installed or updated any of these packages in the last few days, your machine or CI pipeline might already be leaking secrets.
Let's get into what actually happened, what's affected, and what you should do right now.
What Is Shai-Hulud?
Shai-Hulud is a supply chain attack that works by hijacking maintainer npm accounts, pushing malicious versions of popular packages, and then using those poisoned versions to steal environment variables, API keys, and tokens from any machine that installs them.
It's not the first time we've seen this playbook. The ua-parser-js incident in 2021, the colors.js sabotage in 2022, the xz backdoor in 2024. But Shai-Hulud is faster and more coordinated than most previous attempts. It hits multiple packages at once across related ecosystems, which means the blast radius is wider than a single compromised package.
What Got Compromised?
The confirmed compromised packages include:
Keyv ecosystem:
keyv- the popular key-value storage adapter. If you use it directly or as a dependency through Fastify, cacheable-request, or similar tools, you're in scope.@keyv/redis,@keyv/mongo,@keyv/sqlite, and several other adapter packages under the Keyv namespace.
TanStack ecosystem: This is where it gets ugly. TanStack is huge. The attack reportedly hit packages across multiple TanStack libraries:
@tanstack/react-table@tanstack/react-query@tanstack/router@tanstack/virtual@tanstack/form- Plus dozens of sub-packages and related utilities under the
@tanstackscope.
The compromised versions contain obfuscated JavaScript that executes a post-install script. That script harvests environment variables - including npm_token, GITHUB_TOKEN, AWS credentials, .env files, and anything else sitting in your shell environment - and exfiltrates them to an external server.
One particularly nasty detail: the malware also scans for .git/config and SSH keys. So it's not just grabbing API tokens. It's going after your ability to push code.
How Did This Happen?
The attack vector was maintainer account compromise. Someone got hold of the npm credentials for the maintainers of these packages, then published new versions containing the malicious payload.
npm doesn't enforce 2FA on package publishing by default. You can enable it, and you absolutely should, but many maintainers - especially those maintaining dozens of packages - haven't turned it on for every single publish. That's the gap Shai-Hulud exploited.
The malicious versions were published as minor or patch bumps, so automated dependency update tools like Dependabot, Renovate, or plain npm update would pull them in without raising flags.
How to Check If You're Affected
Step 1: Check your lock file.
Open package-lock.json, yarn.lock, or pnpm-lock.yaml and search for keyv and @tanstack. Look at the exact resolved versions. Compare them against the safe versions listed in npm's security advisories or the GitHub advisory database.
If you're not sure what's safe, pin to the last known good version and wait. Don't update blindly.
Step 2: Check your node_modules.
ls node_modules/keyv/package.json
grep version node_modules/keyv/package.jsonSame for any @tanstack/* packages. If the version in your installed node_modules matches a compromised version, assume your environment is tainted.
Step 3: Rotate your secrets.
Even if you're not 100% sure you were hit, rotate any credentials that were available in your development environment or CI system. That means:
- npm tokens
- GitHub/GitLab tokens
- AWS access keys
- Any API keys in
.envfiles - SSH keys if they were accessible during install
This is annoying. But the alternative is worse.
What to Do Right Now
Immediate actions:
-
Don't install or update Keyv or TanStack packages until the all-clear. If you're using
^or~version ranges, the nextnpm installcould pull the compromised version. -
Pin your versions. Remove the caret and tilde. Use exact versions in your
package.json:
"keyv": "4.5.4"Not "keyv": "^4.5.4". Not right now.
-
Regenerate your lock file from a known-good commit. If you have a Git history from before the compromise window, check out that version and reinstall.
-
Audit your CI/CD pipelines. If your GitHub Actions or GitLab CI installs npm packages during builds, those tokens are exposed too. Rotate CI secrets and check your audit logs for unexpected access.
-
Check npm audit:
npm auditThis won't catch everything - especially if the advisory database hasn't been updated yet - but it's a starting point.
Longer-term fixes:
- Enable 2FA on your npm account. Not just for login, but for package publishing specifically (
npm profile enable-2fa auth-and-writes). - Use
npm ciinstead ofnpm installin CI. It respects the lock file exactly and won't pull new versions. - Consider using a tool like Socket.dev or Snyk to monitor dependency behavior, not just known CVEs. Behavioral analysis catches attacks like this faster than waiting for a formal advisory.
- Run installs with
-ignore-scriptswhen you can. The malicious payload in Shai-Hulud executes as a post-install script. Blocking scripts prevents that execution path, though some legitimate packages need scripts to work.
The Bigger Problem
npm has a trust problem. There are over two million packages on the registry, most of them maintained by individuals with no corporate backing, no security team, and no budget for audits. We lean on these packages for everything, and the supply chain that delivers them is held together by a maintainer's email password and a hope that nobody targets them.
Shai-Hulud isn't the last attack like this. It's just the latest one that got caught. The next one might not.
Check your dependencies. Rotate your secrets. And maybe stop auto-merging dependency bumps without looking at what changed.
