Shai-Hulud supply chain attack: the keyv/cacheable npm package family was compromised on 2026-08-04 after attackers took over the maintainer's GitHub account, pushed malicious files to the main branch, and immediately cut new releases (published to npm with valid GitHub Actions provenance). Each affected version adds setup.mjs and Math_Symbol.js plus a "preinstall": "node setup.mjs" entry in package.json, so the payload executes automatically during npm install. setup.mjs is an obfuscated dropper that silently downloads the Bun runtime from github.com/oven-sh/bun/releases/download/bun-v1.3.13/ and uses it to run Math_Symbol.js, which harvests npm registry auth tokens from .npmrc, GitHub CLI tokens (classic PATs, session tokens and OIDC tokens), AWS access keys and session tokens from ~/.aws/credentials, and HashiCorp Vault client tokens from VAULT_TOKEN (with an HTTP fallback). The worm also spread to additional maintainers and organisations, including @deliveroo/reevent, @or-sdk/invitations, @picsart/ai-sdk and @qlik/embed-runtime.