http://www.cybersecurityos.net/tags/shai-hulud/Recent content in Shai-Hulud on CybersecurityOSHugoen-usTue, 04 Aug 2026 11:15:15 -0500http://www.cybersecurityos.net/posts/devsecops/keyv-npm-worm-supply-chain-defense/Tue, 04 Aug 2026 00:00:00 +0000http://www.cybersecurityos.net/posts/devsecops/keyv-npm-worm-supply-chain-defense/<p>On August 4, 2026, a developer somewhere ran <code>npm install</code>. Before a single line of their own code executed, a worm had already read their AWS keys, their npm token, their GitHub credentials, and the secrets sitting in their CI runner&rsquo;s memory. Then it used those credentials to publish poisoned versions of every package it could reach — at roughly one package per second.</p> <p><img src="http://www.cybersecurityos.net/posts/devsecops/images/keyv-npm-worm-hero.svg" alt="The keyv Worm Turned Credential Rotation Into a Trigger"></p>