---
title: Massive Supply-Chain Attack Hits 440+ npm Packages in Under Four Hours
description: A GitHub account hijack spread malware across hundreds of npm packages, stealing credentials and crypto wallets. Rotate your tokens now.
canonical_url: https://codekeeper.co/ticker/github-account-hijack-infects-npm-packages
---

# Massive Supply-Chain Attack Hits 440+ npm Packages in Under Four Hours

A GitHub account hijack spread malware across hundreds of npm packages, stealing credentials and crypto wallets. Rotate your tokens now.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 5, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A single attacker hijacked a GitHub maintainer account on 4 August and unleashed self-replicating malware. More than 440 npm packages were compromised in under four hours, rising to over 860 in total, with more than 2 billion combined monthly installs. The worm first hit keyv, a package with 600 million monthly downloads, then spread to flat-cache, file-entry-cache and hundreds more. Built on the Mini Shai-Hulud framework, it steals npm, GitHub, AWS and CI credentials, plus crypto wallets and AI config files. Compromised packages appear in 46% of all cloud environments — up from around 28% in earlier Shai-Hulud campaigns. Researchers from Wiz, Aikido, Microsoft and Socket are tracking the attack and have published indicators of compromise. Rotate npm, GitHub and AWS credentials immediately. Infected packages carry setup.mjs and Math_Symbol.js plus a preinstall hook, and the worm persists through VS Code and Claude Code config files — so removing the package alone won't evict it. **Source:** [CyberScoop](https://cyberscoop.com/supply-chain-attack-malware-mini-shai-hulud-teampcp/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgithub-account-hijack-infects-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[FBI-Flagged Phishing Kit Kali365 Expands Beyond Microsoft 365 Aug 12, 2026](https://codekeeper.co/ticker/kali365-phishing-service-expands-targets)

[Cyberattacks Claude AI Used to Run Nearly Every Stage of a Live Ransomware Campaign Aug 20, 2026](https://codekeeper.co/ticker/ai-driven-ransomware-attacks-gambit-security-report)

[Russian Hackers Are Still Exploiting a Year-Old WinRAR Flaw Against Ukraine Aug 12, 2026](https://codekeeper.co/ticker/russian-hackers-exploit-winrar-flaw)

[Software security Critical Flaw Let Any Website Run Code on Machines Used for SWIFT Oct 5, 2026](https://codekeeper.co/ticker/sconnect-vulnerability-swift-users-switch)