What happened
On 4 August 2026 attackers compromised a GitHub maintainer account and published malicious versions of keyv, @cacheable/utils, cache-manager and cacheable-request. A self-propagating worm — 'Shai-Hulud: Here We Go Again' — used npm preinstall hooks and IDE-persistence payloads to steal cloud credentials, infrastructure secrets and wallets, ultimately affecting over 400 packages.
Why it matters
Preinstall hooks run before your application code, so a single `npm install` on a laptop or CI runner is enough to execute attacker code with your credentials in scope. The blast radius is every service that transitively depended on these widely-used caching libraries.
Treat this as an identity-and-provenance problem, not a 'bump the version' problem. The Staff-level work is knowing exactly where the packages were pulled, rotating anything a build machine could touch, and moving toward pinned, provenance-verified, allowlisted dependencies so the next worm can't run arbitrary install scripts.
A widely-used transitive dependency ships a malicious preinstall script. How do you scope the blast radius and drive the response across dozens of services?
Probes incident response, credential rotation, and supply-chain hardening.