📰 Shai-Hulud npm Worm Compromises 868 Packages With Over 2 Billion Monthly Installs

Shai-Hulud has escalated again, with a new npm supply chain campaign that hijacked the maintainer of keyv and rippled across at least 868 packages, collectively exceeding 2 billion monthly installs at the time of discovery. On August 4, 2026, attackers took over the GitHub account of the maintainer behind keyv, a key‑value storage library that...