Hackers gained access to the account of a developer who maintains the popular keyv software toolset, used by millions of programmers worldwide. Through this access, the attackers embedded a virus into new versions of the tools, as reported by cybersecurity specialists Aikido Security. The attack began on August 4, 2026, and has become one of the largest in recent years—hundreds of software packages used over 2 billion times a month are at risk.
How Computers Were Infected
All programmers use special repositories of ready-made code snippets—a kind of library from which you can download a ready-made solution instead of writing it from scratch. For JavaScript, such a repository is called npm, and the download command is npm install.
The hackers hid a single line of code in a library update that automatically triggered the download of the virus—immediately after the programmer entered the usual installation command. No suspicious actions were required: infection occurred automatically, as part of routine work.
What the Virus Sought on Infected Computers
Once on a computer, the malicious program began searching for everything of value:
- Passwords and access codes to the software repository (npm)
- Access codes for GitHub accounts—the service for storing source code
- Login credentials for Amazon cloud services (AWS)
- Secret keys to companies' server infrastructure
- Keys for remote access to servers (SSH)
- Files with saved passwords (KeePass program)
- Settings of popular code writing programs, including Claude, VS Code, and others
- Crypto wallet files—including wallets for Solana and Monero
- Seed phrases and private keys
The virus encrypted everything it found and sent it to the hackers: some data was uploaded to public GitHub repositories with the telling name "Shai-Hulud: Back Again," some—to a special server, the address of which the virus obtained via a smart contract on the Ethereum network, making it harder to block.
The Virus Multiplied on Its Own
Most dangerously, the virus didn't stop at one library. Using stolen passwords, it independently infected other popular tools: it released new "updates" on behalf of real developers, adding the same malicious line of code, and then published them publicly. Simultaneously, the virus hid deeper in the system, making it more difficult to remove completely.
How Many Programs Are Already Infected
According to Aikido Security data as of August 5, 2026, at least 444 software packages (1,381 versions) are infected. An Orca Security report mentions a figure of about 868 packages. Among them are several tools used by tens of thousands of other developers worldwide to speed up and simplify coding.
Why This Is Especially Dangerous for the Crypto Industry
If the virus lands on the computer of a developer working on a crypto project, the consequences can be much more serious than a simple password leak. Through the infected computer, hackers gain access to secret wallet phrases, exchange keys, GitHub accounts, and company servers, as explained by Orca Security. The rest is just a matter of technique: access to the project's code, access to servers, and then a full-fledged hack. This is exactly how many major cryptocurrency thefts have begun in recent years.
This story shows that infection is possible even during the most routine actions—simply installing a needed tool for work. For teams dealing with cryptocurrency and wallets, this is an extra reason to carefully check which programs they use and update them promptly after the problem is fixed.
AI Opinion
From the perspective of machine data analysis, the current incident is not an isolated case, but the third wave of the same campaign: the Shai-Hulud worm was first detected in September 2025, followed by a second wave, "Shai-Hulud 2.0," in November, affecting over 25,000 repositories. Such regularity in less than a year points to a systemic issue of trust within the npm ecosystem, not a one-time mistake by a single developer.
end-content
