What the Shai-Hulud npm worm means for dsh users
Published 18 August 2026
On 4 August 2026, a worm researchers named Shai-Hulud compromised keyv and cacheable — npm packages most JavaScript developers have installed without ever choosing them. A dsh plugin is an npm package. This article is about what that coincidence of timing means for an ecosystem that is days old.
What happened
According to Wiz's analysis, the attacker used a compromised maintainer identity to publish malicious versions of keyv, then spread through legitimate GitHub Actions workflows into more than 400 packages that together see roughly two billion downloads a month.
The wave that should worry agent users is the sixth. Its payload hid inside AI agent configuration files — files no conventional scanner reads. Command-and-control ran over an Ethereum smart contract instead of a domain that could be seized. And it shipped a watcher that fired attacker-controlled code the moment defenders tried to rotate the stolen credentials.
Why this lands on dsh
A dsh plugin is an npm package plus an entry in cordis.yml. Installing one runs npm's whole machinery — install scripts, transitive dependencies, whatever the lockfile did not pin — and then loads the result into the process that holds your API keys and runs your shell. Every mechanism Shai-Hulud used exists unchanged in this ecosystem.
The detail worth remembering: the payload lived in agent config files. In dsh, the loader config is the attack surface — cordis.yml decides what code enters the process. A file most people copy from a README without reading is exactly where this class of attack goes to hide.
Has a dsh plugin been hit?
Not that anyone has demonstrated. As of publication (18 August 2026) we know of no confirmed malicious package among the 1805 repos we index. But the topic is an open tag with no review behind it, the ecosystem is days old, and the npm attack above was live two weeks before dsh launched. The absence of a confirmed case this early is not evidence of safety.
Where a listing carries a checkable warning sign — a name one edit away from a more popular repo, a homepage behind a link shortener, a description that pipes a download into a shell — we print that fact on the listing. We do not print verdicts; repo metadata cannot support them.
What to actually do
Pin the exact versions you have reviewed, commit your lockfile, and keep production credentials out of the environment where you try new plugins. Before adding anything to cordis.yml, run through the full vetting checklist. If you find something malicious in a repo we index, report it — we delist confirmed cases.