Shai-Hulud Supply Chain Attack Compromises Keyv npm Packages, Exposing Secrets

A coordinated supply chain attack named Shai-Hulud compromised Keyv, a widely used Node.js key-value storage library, along with several of its adapter packages including Redis, MongoDB, and SQLite integrations. Security researchers detected the campaign in mid-2026 after malicious versions were published to the npm registry through compromised maintainer accounts. The injected code silently exfiltrates environment variables, API keys, and database credentials without disrupting normal application functionality, making it difficult to detect. Keyv receives tens of millions of weekly downloads and is often used as an indirect dependency, meaning many developers may be affected without realising it. Developers are urged to audit their package-lock.json files, rotate all exposed secrets, and pin dependencies to verified clean versions immediately.