keyv and cacheable npm Package Hijacked in Supply Chain Attack

Wiz Research is investigating an ongoing software supply-chain attack that began with a compromised GitHub maintainer account and resulted in malicious versions of keyv/cacheable ecosystem npm packages (now propagated to hundreds of packages). The malware is a variant of the 'Mini' Shai-Hulud family that steals cloud and developer credentials, attempts IDE/CI persistence, exfiltrates data via GitHub repos, and dynamically retrieves C2 domains from an Ethereum smart contract; the report includes affected package versions, file hashes, domains, user-agents, and recommended mitigations.