SECURITY Signal 418
The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one
↗
An attacker compromised the GitHub account of the maintainer of keyv, a small key-value storage library downloaded roughly 127 million times weekly on npm, and published poisoned versions carrying a credential-stealing worm that obtained a legitimate security check.
The worm earned rather than faked its security verification, meaning existing security badge mechanisms failed to catch malicious code published from a compromised trusted account. For anyone relying on npm security signals to vet dependencies, legitimate checks no longer guarantee safety if maintainer accounts can be taken over.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
An attacker took over the GitHub account of the developer maintaining keyv, a package npm serves roughly 127 million times per week.
Poisoned versions of keyv and related caching packages carrying a credential-stealing worm were live on npm within hours of the takeover.
The worm obtained a legitimate security check rather than faking one, undermining trust in verified security badges.
THE CLUSTER