“Old Father Eternity”: Shai-Hulud Worm Strikes a 6th Time – keyv/cacheable npm Supply Chain Attack

Checkmarx Zero reports an active, large-scale npm supply-chain campaign (a Shai-Hulud variant) that injects malware into widely used packages (e.g., keyv, cacheable), steals credentials from over 200 file paths and cloud metadata endpoints, and self-propagates across npm packages and GitHub repositories using sophisticated multi-channel C2 (including an Ethereum smart contract and GitHub commits). The report includes IoCs (malicious filenames, hashes, domains, an Ethereum address, malicious workflow/branch names), lists affected package versions, outlines the six-stage attack chain, and provides containment and remediation steps including credential rotation, artifact scanning, and blocking malicious package versions.