TeamPCP worm hits 440 npm packages in under four hours
The keyv maintainer was the initial vector. 46% of all cloud environments contain at least one of the compromised packages, nearly double the exposure of Shai-Hulud 2.0.
TL;DR
An attacker compromised a GitHub maintainer account early Tuesday and deployed a Mini Shai-Hulud variant that self-replicated into more than 440 npm packages before the wave subsided within four hours. The initial entry was keyv (600M+ monthly downloads), followed by cacheable, flat-cache, and file-entry-cache, all under the same maintainer. Wiz reports the affected packages are present in over 46% of cloud environments. The malware harvests npm tokens, GitHub tokens, AWS credentials, CI secrets, AI config files, and cryptocurrency wallets. Researchers attribute the pattern to TeamPCP but lack hard links as of now.
The speed is what distinguishes this attack from the five previous Shai-Hulud waves. The entire campaign (from initial maintainer compromise through self-replication across 440+ packages) completed in under four hours. The worm stopped spreading after that initial burst, and Wiz says it hasn't observed new malicious packages since. That isn't containment. It's the attacker deciding the job was done.
The exposure footprint is substantially larger than any prior wave. In the Shai-Hulud 2.0 campaign last September, the most prevalent compromised packages appeared in about 28% of cloud environments. This time, Wiz pegs the figure at over 46%, driven by how deeply keyv and its sibling packages are embedded in the ecosystem. The combined monthly download count across all affected packages exceeds 2 billion.
What the payload does, and what removal doesn't fix
This Mini Shai-Hulud variant steals npm and GitHub tokens, AWS credentials, CI/CD secrets, SSH keys, AI configuration files, and cryptocurrency wallets. Like earlier versions, it embeds persistence in developer tool settings, .vscode/tasks.json and .claude/settings.json, that survive a simple package rollback. Removing the dependency does not close the backdoor. Any environment where an affected package was installed should be treated as exposed until secrets are rotated and persistence artifacts are purged.
Attribution leans TeamPCP but isn't sealed
Wiz, Microsoft, Socket, and Aikido all observed the same payload and pattern across affected packages, pointing to a single operator or cluster. The malware is built from the open-source Mini Shai-Hulud repository that TeamPCP published in May, and the core mechanisms (token harvesting, self-replication via stolen publish credentials, CI/CD pipeline compromise) are consistent with the group's playbook. But Wiz cautions that hard attribution links aren't in hand yet. TeamPCP has burned through more than 1,000 compromised packages since early 2026; this wave, in four hours, may have done more damage than any of them.
Published ·Deep Fathom