New npm Worm Hits 400+ Packages Including Keyv, Cachable

This report describes an active npm-based worm (Mini Shai-Hulud family) that has compromised 400+ packages and 2,000+ malicious versions to steal a wide range of developer and cloud credentials (GitHub, npm, AWS, Vault, Kubernetes, Azure, GCP, Terraform, Docker, Slack, etc.), exfiltrate data via a dynamic C2 and public GitHub repositories, and propagate by publishing poisoned npm releases and injecting GitHub workflows and commits; it includes technical analysis, SHA-256 hashes, IOCs, and containment/response guidance.