# keyv / cacheable family hijacked in Shai-Hulud "Here We Go Again" worm

> On 2026-08-04 a compromised maintainer account pushed a `preinstall` credential stealer into the `keyv` / `cacheable` family and the worm spread via stolen npm tokens across ~2B monthly installs. Releases were cut from `main`, so npm signed them with valid provenance. Verified count as of the Wiz IOC feed: **443 npm packages across 2,235 versions**; SafeDep's registry-backed telemetry puts the total at 1,684 versions across 420 names tied to nine orgs.

- Published: 2026-08-04
- Last updated: 2026-08-17
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: npm
- Scope: 443 packages, 2235 compromised versions
- Tags: worm, maintainer-takeover, account-takeover, credential-theft, ci-cd-compromise, crypto-wallet-drain, obfuscation
- Also known as: Shai-Hulud: Here We Go Again, keyv/cacheable compromise
- Detected by: Aikido Security, Wiz, Datadog Security Labs, SafeDep, Snyk, Socket
- Incident ID: npm-2026-08-04-shai-hulud-keyv-cacheable

## Affected packages (443)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@adminide-stack/clock-tik-browser](https://dependencywatch.io/package/npm/@adminide-stack/clock-tik-browser) | npm | 12.0.24 |
| [@adminide-stack/yantra-mobile](https://dependencywatch.io/package/npm/@adminide-stack/yantra-mobile) | npm | 12.0.33 |
| [@arv-bedrock/auth](https://dependencywatch.io/package/npm/@arv-bedrock/auth) | npm | 1.1.7, 1.1.8 |
| [@arv-bedrock/auth-admin](https://dependencywatch.io/package/npm/@arv-bedrock/auth-admin) | npm | 1.0.2, 1.0.3 |
| [@arv-bedrock/auth-sso](https://dependencywatch.io/package/npm/@arv-bedrock/auth-sso) | npm | 1.6.1, 1.6.2 |
| [@arv-bedrock/auth-sso-backend](https://dependencywatch.io/package/npm/@arv-bedrock/auth-sso-backend) | npm | 1.7.1, 1.7.2 |
| [@arv-bedrock/logger](https://dependencywatch.io/package/npm/@arv-bedrock/logger) | npm | 1.7.1, 1.7.2 |
| [@cacheable/memory](https://dependencywatch.io/package/npm/@cacheable/memory) | npm | 2.2.1 |
| [@cacheable/net](https://dependencywatch.io/package/npm/@cacheable/net) | npm | 2.1.1 |
| [@cacheable/node-cache](https://dependencywatch.io/package/npm/@cacheable/node-cache) | npm | 3.1.2 |
| [@cacheable/utils](https://dependencywatch.io/package/npm/@cacheable/utils) | npm | 2.5.1 |
| [@deliveroo/determinator](https://dependencywatch.io/package/npm/@deliveroo/determinator) | npm | 0.2.1 |
| [@deliveroo/reevent](https://dependencywatch.io/package/npm/@deliveroo/reevent) | npm | 1.0.1 |
| [@hubsync/web-sdk-react](https://dependencywatch.io/package/npm/@hubsync/web-sdk-react) | npm | 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.3.15, 6.3.16, 6.3.17, 6.3.18, 6.3.19, 6.3.20, 6.3.21, 6.3.22, 6.3.23, 6.3.24, 6.3.25, 6.3.26, 6.3.27, 6.3.28, 6.3.29, 6.3.30, 6.3.31, 6.3.32, 6.3.33 |
| [@nebula.js/cli](https://dependencywatch.io/package/npm/@nebula.js/cli) | npm | 7.1.2 |
| [@nebula.js/cli-build](https://dependencywatch.io/package/npm/@nebula.js/cli-build) | npm | 7.1.2 |
| [@nebula.js/cli-sense](https://dependencywatch.io/package/npm/@nebula.js/cli-sense) | npm | 7.1.2 |
| [@nebula.js/locale](https://dependencywatch.io/package/npm/@nebula.js/locale) | npm | 0.6.2 |
| [@nebula.js/nucleus](https://dependencywatch.io/package/npm/@nebula.js/nucleus) | npm | 0.5.1 |
| [@nebula.js/sn-action-button](https://dependencywatch.io/package/npm/@nebula.js/sn-action-button) | npm | 2.3.1 |
| [@nebula.js/sn-animator](https://dependencywatch.io/package/npm/@nebula.js/sn-animator) | npm | 2.13.1 |
| [@nebula.js/sn-distributionplot](https://dependencywatch.io/package/npm/@nebula.js/sn-distributionplot) | npm | 1.0.7 |
| [@nebula.js/sn-layout-container](https://dependencywatch.io/package/npm/@nebula.js/sn-layout-container) | npm | 4.4.1 |
| [@nebula.js/sn-line-chart](https://dependencywatch.io/package/npm/@nebula.js/sn-line-chart) | npm | 2.7.1 |
| [@nebula.js/sn-listbox](https://dependencywatch.io/package/npm/@nebula.js/sn-listbox) | npm | 0.19.3 |
| [@nebula.js/sn-map](https://dependencywatch.io/package/npm/@nebula.js/sn-map) | npm | 0.12.7 |
| [@nebula.js/sn-nav-menu](https://dependencywatch.io/package/npm/@nebula.js/sn-nav-menu) | npm | 0.14.2 |
| [@nebula.js/sn-org-chart](https://dependencywatch.io/package/npm/@nebula.js/sn-org-chart) | npm | 1.7.1 |
| [@nebula.js/sn-shape](https://dependencywatch.io/package/npm/@nebula.js/sn-shape) | npm | 1.5.1 |
| [@nebula.js/sn-slider](https://dependencywatch.io/package/npm/@nebula.js/sn-slider) | npm | 0.20.1 |
| [@nebula.js/sn-tabbed-container](https://dependencywatch.io/package/npm/@nebula.js/sn-tabbed-container) | npm | 2.4.1 |
| [@nebula.js/snapshooter](https://dependencywatch.io/package/npm/@nebula.js/snapshooter) | npm | 0.6.1 |
| [@nebula.js/stardust](https://dependencywatch.io/package/npm/@nebula.js/stardust) | npm | 7.1.2 |
| [@nebula.js/test-utils](https://dependencywatch.io/package/npm/@nebula.js/test-utils) | npm | 0.6.1 |
| [@nebula.js/theme](https://dependencywatch.io/package/npm/@nebula.js/theme) | npm | 0.6.1 |
| [@onereach/authorizer-helper](https://dependencywatch.io/package/npm/@onereach/authorizer-helper) | npm | 0.0.11, 0.0.12, 0.0.13 |
| [@onereach/bandwidth-steps-voice-bxml](https://dependencywatch.io/package/npm/@onereach/bandwidth-steps-voice-bxml) | npm | 0.1.1, 0.1.2, 0.1.3 |
| [@onereach/billing-dto](https://dependencywatch.io/package/npm/@onereach/billing-dto) | npm | 27.2.1, 27.2.2, 27.2.3 |
| [@onereach/billing-shared](https://dependencywatch.io/package/npm/@onereach/billing-shared) | npm | 27.2.1, 27.2.2, 27.2.3 |
| [@onereach/cb-schema-translator](https://dependencywatch.io/package/npm/@onereach/cb-schema-translator) | npm | 1.3.1, 1.3.2, 1.3.3 |
| [@onereach/channel-transformer](https://dependencywatch.io/package/npm/@onereach/channel-transformer) | npm | 0.0.66, 0.0.67, 0.0.68 |
| [@onereach/channel-transformers](https://dependencywatch.io/package/npm/@onereach/channel-transformers) | npm | 0.0.5, 0.0.6, 0.0.7 |
| [@onereach/ckeditor5-build-classic](https://dependencywatch.io/package/npm/@onereach/ckeditor5-build-classic) | npm | 30.0.1, 30.0.2, 30.0.3 |
| [@onereach/condition-builder](https://dependencywatch.io/package/npm/@onereach/condition-builder) | npm | 1.0.8, 1.0.9, 1.0.10 |
| [@onereach/content-builder](https://dependencywatch.io/package/npm/@onereach/content-builder) | npm | 0.0.18, 0.0.19, 0.0.20 |
| [@onereach/content-builder-template-compiler](https://dependencywatch.io/package/npm/@onereach/content-builder-template-compiler) | npm | 0.0.3, 0.0.4, 0.0.5 |
| [@onereach/expression-components](https://dependencywatch.io/package/npm/@onereach/expression-components) | npm | 9.1.1, 9.1.2, 9.1.3 |
| [@onereach/font-icons](https://dependencywatch.io/package/npm/@onereach/font-icons) | npm | 27.0.2, 27.0.3, 27.0.4 |
| [@onereach/get-version-data](https://dependencywatch.io/package/npm/@onereach/get-version-data) | npm | 3.1.2, 3.1.3, 3.1.4 |
| [@onereach/idw-apps](https://dependencywatch.io/package/npm/@onereach/idw-apps) | npm | 0.1.3, 0.1.4, 0.1.5 |
| [@onereach/idw-contracts](https://dependencywatch.io/package/npm/@onereach/idw-contracts) | npm | 0.1.2, 0.1.3, 0.1.4 |
| [@onereach/idw-init-account-resources](https://dependencywatch.io/package/npm/@onereach/idw-init-account-resources) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [@onereach/idw-sdk](https://dependencywatch.io/package/npm/@onereach/idw-sdk) | npm | 0.1.2, 0.1.3, 0.1.4 |
| [@onereach/idw-ui-components](https://dependencywatch.io/package/npm/@onereach/idw-ui-components) | npm | 0.1.2, 0.1.3, 0.1.4 |
| [@onereach/lambda-invocation](https://dependencywatch.io/package/npm/@onereach/lambda-invocation) | npm | 1.2.1, 1.2.2, 1.2.3 |
| [@onereach/messengers-infobip-sdk](https://dependencywatch.io/package/npm/@onereach/messengers-infobip-sdk) | npm | 0.1.1, 0.1.2, 0.1.3 |
| [@onereach/or-browser](https://dependencywatch.io/package/npm/@onereach/or-browser) | npm | 0.0.48, 0.0.49, 0.0.50 |
| [@onereach/or-browser-next](https://dependencywatch.io/package/npm/@onereach/or-browser-next) | npm | 0.0.11, 0.0.12, 0.0.13 |
| [@onereach/or-content-builder-renderer](https://dependencywatch.io/package/npm/@onereach/or-content-builder-renderer) | npm | 0.0.2, 0.0.3, 0.0.4 |
| [@onereach/or-file-uploader-next](https://dependencywatch.io/package/npm/@onereach/or-file-uploader-next) | npm | 0.0.8, 0.0.9, 0.0.10 |
| [@onereach/or-pro](https://dependencywatch.io/package/npm/@onereach/or-pro) | npm | 1.13.1, 1.13.2, 1.13.3 |
| [@onereach/or-sdk-agent-cli](https://dependencywatch.io/package/npm/@onereach/or-sdk-agent-cli) | npm | 0.0.6, 0.0.7, 0.0.8 |
| [@onereach/orest-cli](https://dependencywatch.io/package/npm/@onereach/orest-cli) | npm | 2.4.1, 2.4.2, 2.4.3 |
| [@onereach/orest-input-cli](https://dependencywatch.io/package/npm/@onereach/orest-input-cli) | npm | 1.18.1, 1.18.2, 1.18.3 |
| [@onereach/orest-jest-presets](https://dependencywatch.io/package/npm/@onereach/orest-jest-presets) | npm | 0.0.3, 0.0.4, 0.0.5 |
| [@onereach/orest-vue-demi-vue2](https://dependencywatch.io/package/npm/@onereach/orest-vue-demi-vue2) | npm | 0.0.4, 0.0.5, 0.0.6 |
| [@onereach/orest-vue-demi-vue3](https://dependencywatch.io/package/npm/@onereach/orest-vue-demi-vue3) | npm | 0.0.4, 0.0.5, 0.0.6 |
| [@onereach/orest-vue3](https://dependencywatch.io/package/npm/@onereach/orest-vue3) | npm | 0.0.4, 0.0.5, 0.0.6 |
| [@onereach/phonenumber-interpreter](https://dependencywatch.io/package/npm/@onereach/phonenumber-interpreter) | npm | 0.0.18, 0.0.19, 0.0.20 |
| [@onereach/pnpm-audit-junit](https://dependencywatch.io/package/npm/@onereach/pnpm-audit-junit) | npm | 1.0.3, 1.0.4, 1.0.5 |
| [@onereach/postcss-scoped-selector](https://dependencywatch.io/package/npm/@onereach/postcss-scoped-selector) | npm | 1.2.1, 1.2.2, 1.2.3 |
| [@onereach/regex-helper](https://dependencywatch.io/package/npm/@onereach/regex-helper) | npm | 0.5.16, 0.5.17, 0.5.18 |
| [@onereach/regular-expressions](https://dependencywatch.io/package/npm/@onereach/regular-expressions) | npm | 0.5.23, 0.5.24, 0.5.25 |
| [@onereach/regular-expressions-test](https://dependencywatch.io/package/npm/@onereach/regular-expressions-test) | npm | 0.0.4, 0.0.5, 0.0.6 |
| [@onereach/rwc-client](https://dependencywatch.io/package/npm/@onereach/rwc-client) | npm | 6.4.7, 6.4.8, 6.4.9 |
| [@onereach/salesforce-miaw-client](https://dependencywatch.io/package/npm/@onereach/salesforce-miaw-client) | npm | 0.0.3, 0.0.4, 0.0.5 |
| [@onereach/si-a-button](https://dependencywatch.io/package/npm/@onereach/si-a-button) | npm | 0.0.3, 0.0.4, 0.0.5 |
| [@onereach/si-alert](https://dependencywatch.io/package/npm/@onereach/si-alert) | npm | 0.4.11, 0.4.12, 0.4.13 |
| [@onereach/si-checkbox](https://dependencywatch.io/package/npm/@onereach/si-checkbox) | npm | 0.6.5, 0.6.6, 0.6.7 |
| [@onereach/si-checkbox-group](https://dependencywatch.io/package/npm/@onereach/si-checkbox-group) | npm | 0.3.5, 0.3.6, 0.3.7 |
| [@onereach/si-code](https://dependencywatch.io/package/npm/@onereach/si-code) | npm | 0.6.4, 0.6.5, 0.6.6 |
| [@onereach/si-collapsible-group](https://dependencywatch.io/package/npm/@onereach/si-collapsible-group) | npm | 0.6.4, 0.6.5, 0.6.6 |
| [@onereach/si-copyable-text](https://dependencywatch.io/package/npm/@onereach/si-copyable-text) | npm | 0.4.11, 0.4.12, 0.4.13 |
| [@onereach/si-datepicker](https://dependencywatch.io/package/npm/@onereach/si-datepicker) | npm | 0.4.5, 0.4.6, 0.4.7 |
| [@onereach/si-divider](https://dependencywatch.io/package/npm/@onereach/si-divider) | npm | 0.4.11, 0.4.12, 0.4.13 |
| [@onereach/si-dropdown-advanced](https://dependencywatch.io/package/npm/@onereach/si-dropdown-advanced) | npm | 0.4.5, 0.4.6, 0.4.7 |
| [@onereach/si-dropdown-simple](https://dependencywatch.io/package/npm/@onereach/si-dropdown-simple) | npm | 0.4.5, 0.4.6, 0.4.7 |
| [@onereach/si-header](https://dependencywatch.io/package/npm/@onereach/si-header) | npm | 0.4.11, 0.4.12, 0.4.13, 0.4.14 |
| [@onereach/si-list](https://dependencywatch.io/package/npm/@onereach/si-list) | npm | 0.7.4, 0.7.5, 0.7.6 |
| [@onereach/si-merge-tag-input](https://dependencywatch.io/package/npm/@onereach/si-merge-tag-input) | npm | 0.4.5, 0.4.6, 0.4.7 |
| [@onereach/si-radio-group](https://dependencywatch.io/package/npm/@onereach/si-radio-group) | npm | 0.3.5, 0.3.6, 0.3.7 |
| [@onereach/si-root](https://dependencywatch.io/package/npm/@onereach/si-root) | npm | 0.9.4, 0.9.5, 0.9.6 |
| [@onereach/si-select](https://dependencywatch.io/package/npm/@onereach/si-select) | npm | 0.1.3, 0.1.4, 0.1.5 |
| [@onereach/si-step-chooser](https://dependencywatch.io/package/npm/@onereach/si-step-chooser) | npm | 0.4.4, 0.4.5, 0.4.6 |
| [@onereach/si-switch](https://dependencywatch.io/package/npm/@onereach/si-switch) | npm | 0.4.5, 0.4.6, 0.4.7 |
| [@onereach/si-text-message](https://dependencywatch.io/package/npm/@onereach/si-text-message) | npm | 0.4.5, 0.4.6, 0.4.7 |
| [@onereach/si-textinput](https://dependencywatch.io/package/npm/@onereach/si-textinput) | npm | 0.5.5, 0.5.6, 0.5.7 |
| [@onereach/si-validated-timestring-input](https://dependencywatch.io/package/npm/@onereach/si-validated-timestring-input) | npm | 0.3.5, 0.3.6, 0.3.7 |
| [@onereach/slack-helpers](https://dependencywatch.io/package/npm/@onereach/slack-helpers) | npm | 1.0.3, 1.0.4, 1.0.5 |
| [@onereach/ssml-editor](https://dependencywatch.io/package/npm/@onereach/ssml-editor) | npm | 2.0.12, 2.0.13, 2.0.14 |
| [@onereach/step-components](https://dependencywatch.io/package/npm/@onereach/step-components) | npm | 0.1.37, 0.1.38, 0.1.39 |
| [@onereach/step-conversation](https://dependencywatch.io/package/npm/@onereach/step-conversation) | npm | 1.0.41, 1.0.42, 1.0.43 |
| [@onereach/step-run-snowflake-query](https://dependencywatch.io/package/npm/@onereach/step-run-snowflake-query) | npm | 0.1.1, 0.1.2, 0.1.3 |
| [@onereach/step-voice](https://dependencywatch.io/package/npm/@onereach/step-voice) | npm | 7.0.32, 7.0.33, 7.0.34 |
| [@onereach/styles](https://dependencywatch.io/package/npm/@onereach/styles) | npm | 27.0.2, 27.0.3, 27.0.4 |
| [@onereach/time-interpreter](https://dependencywatch.io/package/npm/@onereach/time-interpreter) | npm | 1.0.30, 1.0.31, 1.0.32 |
| [@onereach/ts-memoize](https://dependencywatch.io/package/npm/@onereach/ts-memoize) | npm | 1.0.2, 1.0.3, 1.0.4 |
| [@onereach/types-contacts-api](https://dependencywatch.io/package/npm/@onereach/types-contacts-api) | npm | 9.0.8, 9.0.9, 9.0.10 |
| [@onereach/ui-components](https://dependencywatch.io/package/npm/@onereach/ui-components) | npm | 27.0.2, 27.0.3, 27.0.4 |
| [@onereach/ui-components-common](https://dependencywatch.io/package/npm/@onereach/ui-components-common) | npm | 27.0.2, 27.0.3, 27.0.4 |
| [@onereach/ui-components-vue2](https://dependencywatch.io/package/npm/@onereach/ui-components-vue2) | npm | 27.0.2, 27.0.3, 27.0.4 |
| [@onereach/v-event-calendar](https://dependencywatch.io/package/npm/@onereach/v-event-calendar) | npm | 0.1.22, 0.1.23, 0.1.24 |
| [@onereach/webform](https://dependencywatch.io/package/npm/@onereach/webform) | npm | 0.3.13, 0.3.14, 0.3.15 |
| [@or-sdk/account-settings](https://dependencywatch.io/package/npm/@or-sdk/account-settings) | npm | 1.3.6, 1.3.7, 1.3.8 |
| [@or-sdk/accounts](https://dependencywatch.io/package/npm/@or-sdk/accounts) | npm | 2.3.5, 2.3.6, 2.3.7 |
| [@or-sdk/adapters](https://dependencywatch.io/package/npm/@or-sdk/adapters) | npm | 0.3.6, 0.3.7, 0.3.8 |
| [@or-sdk/agents](https://dependencywatch.io/package/npm/@or-sdk/agents) | npm | 4.21.3, 4.21.4, 4.21.5 |
| [@or-sdk/api-tokens](https://dependencywatch.io/package/npm/@or-sdk/api-tokens) | npm | 1.4.2, 1.4.3, 1.4.4 |
| [@or-sdk/api-tokens-lambda](https://dependencywatch.io/package/npm/@or-sdk/api-tokens-lambda) | npm | 1.4.2, 1.4.3, 1.4.4 |
| [@or-sdk/apps](https://dependencywatch.io/package/npm/@or-sdk/apps) | npm | 1.2.6, 1.2.7, 1.2.8 |
| [@or-sdk/auth](https://dependencywatch.io/package/npm/@or-sdk/auth) | npm | 0.38.1, 0.38.2, 0.38.3 |
| [@or-sdk/authorizer](https://dependencywatch.io/package/npm/@or-sdk/authorizer) | npm | 0.26.7, 0.26.8, 0.26.9 |
| [@or-sdk/base](https://dependencywatch.io/package/npm/@or-sdk/base) | npm | 0.44.4, 0.44.5, 0.44.6 |
| [@or-sdk/billing](https://dependencywatch.io/package/npm/@or-sdk/billing) | npm | 27.2.1, 27.2.2, 27.2.3 |
| [@or-sdk/billing-internal](https://dependencywatch.io/package/npm/@or-sdk/billing-internal) | npm | 27.2.1, 27.2.2, 27.2.3 |
| [@or-sdk/bot-templates](https://dependencywatch.io/package/npm/@or-sdk/bot-templates) | npm | 2.2.5, 2.2.6, 2.2.7 |
| [@or-sdk/bots](https://dependencywatch.io/package/npm/@or-sdk/bots) | npm | 1.7.1, 1.7.2, 1.7.3 |
| [@or-sdk/card-templates](https://dependencywatch.io/package/npm/@or-sdk/card-templates) | npm | 2.2.5, 2.2.6, 2.2.7 |
| [@or-sdk/cards](https://dependencywatch.io/package/npm/@or-sdk/cards) | npm | 1.2.5, 1.2.6, 1.2.7 |
| [@or-sdk/ccp](https://dependencywatch.io/package/npm/@or-sdk/ccp) | npm | 10.15.4, 10.15.5, 10.15.6 |
| [@or-sdk/chat](https://dependencywatch.io/package/npm/@or-sdk/chat) | npm | 0.3.1, 0.3.2, 0.3.3 |
| [@or-sdk/contacts](https://dependencywatch.io/package/npm/@or-sdk/contacts) | npm | 4.7.5, 4.7.6, 4.7.7 |
| [@or-sdk/content-request](https://dependencywatch.io/package/npm/@or-sdk/content-request) | npm | 0.2.6, 0.2.7, 0.2.8 |
| [@or-sdk/data-hub](https://dependencywatch.io/package/npm/@or-sdk/data-hub) | npm | 0.26.5, 0.26.6, 0.26.7 |
| [@or-sdk/data-hub-svc](https://dependencywatch.io/package/npm/@or-sdk/data-hub-svc) | npm | 2.3.5, 2.3.6, 2.3.7 |
| [@or-sdk/deployer](https://dependencywatch.io/package/npm/@or-sdk/deployer) | npm | 1.7.5, 1.7.6, 1.7.7 |
| [@or-sdk/deployments](https://dependencywatch.io/package/npm/@or-sdk/deployments) | npm | 2.1.5, 2.1.6, 2.1.7 |
| [@or-sdk/discovery](https://dependencywatch.io/package/npm/@or-sdk/discovery) | npm | 1.12.1, 1.12.2, 1.12.3 |
| [@or-sdk/druid](https://dependencywatch.io/package/npm/@or-sdk/druid) | npm | 1.4.7, 1.4.8, 1.4.9 |
| [@or-sdk/event-manager](https://dependencywatch.io/package/npm/@or-sdk/event-manager) | npm | 1.1.5, 1.1.6, 1.1.7 |
| [@or-sdk/files](https://dependencywatch.io/package/npm/@or-sdk/files) | npm | 3.11.6, 3.11.7, 3.11.8 |
| [@or-sdk/files-sync-node](https://dependencywatch.io/package/npm/@or-sdk/files-sync-node) | npm | 0.1.8, 0.1.9, 0.1.10 |
| [@or-sdk/flow-templates](https://dependencywatch.io/package/npm/@or-sdk/flow-templates) | npm | 2.1.5, 2.1.6, 2.1.7 |
| [@or-sdk/flows](https://dependencywatch.io/package/npm/@or-sdk/flows) | npm | 2.7.8, 2.7.9, 2.7.10 |
| [@or-sdk/graph](https://dependencywatch.io/package/npm/@or-sdk/graph) | npm | 1.10.5, 1.10.6, 1.10.7 |
| [@or-sdk/hitl](https://dependencywatch.io/package/npm/@or-sdk/hitl) | npm | 0.41.1, 0.41.2, 0.41.3 |
| [@or-sdk/identifiers](https://dependencywatch.io/package/npm/@or-sdk/identifiers) | npm | 0.27.6, 0.27.7, 0.27.8 |
| [@or-sdk/idw](https://dependencywatch.io/package/npm/@or-sdk/idw) | npm | 9.0.4, 9.0.5, 9.0.6 |
| [@or-sdk/idw-public](https://dependencywatch.io/package/npm/@or-sdk/idw-public) | npm | 1.6.6, 1.6.7, 1.6.8 |
| [@or-sdk/idw-skill](https://dependencywatch.io/package/npm/@or-sdk/idw-skill) | npm | 1.4.1, 1.4.2, 1.4.3 |
| [@or-sdk/invitations](https://dependencywatch.io/package/npm/@or-sdk/invitations) | npm | 1.4.8, 1.4.9, 1.4.10 |
| [@or-sdk/key-value-storage](https://dependencywatch.io/package/npm/@or-sdk/key-value-storage) | npm | 0.28.6, 0.28.7, 0.28.8 |
| [@or-sdk/keys](https://dependencywatch.io/package/npm/@or-sdk/keys) | npm | 1.2.6, 1.2.7, 1.2.8 |
| [@or-sdk/knowledge-models](https://dependencywatch.io/package/npm/@or-sdk/knowledge-models) | npm | 0.25.5, 0.25.6, 0.25.7 |
| [@or-sdk/library](https://dependencywatch.io/package/npm/@or-sdk/library) | npm | 0.5.6, 0.5.7, 0.5.8 |
| [@or-sdk/library-categories](https://dependencywatch.io/package/npm/@or-sdk/library-categories) | npm | 0.2.6, 0.2.7, 0.2.8 |
| [@or-sdk/library-source](https://dependencywatch.io/package/npm/@or-sdk/library-source) | npm | 0.4.5, 0.4.6, 0.4.7 |
| [@or-sdk/library-types-v1](https://dependencywatch.io/package/npm/@or-sdk/library-types-v1) | npm | 9.0.1, 9.0.2, 9.0.3 |
| [@or-sdk/library-types-v2](https://dependencywatch.io/package/npm/@or-sdk/library-types-v2) | npm | 9.0.1, 9.0.2, 9.0.3 |
| [@or-sdk/lookup](https://dependencywatch.io/package/npm/@or-sdk/lookup) | npm | 1.25.1, 1.25.2, 1.25.3 |
| [@or-sdk/markdowner](https://dependencywatch.io/package/npm/@or-sdk/markdowner) | npm | 0.5.1, 0.5.2, 0.5.3 |
| [@or-sdk/mcp-tools](https://dependencywatch.io/package/npm/@or-sdk/mcp-tools) | npm | 0.5.2, 0.5.3, 0.5.4 |
| [@or-sdk/notifications](https://dependencywatch.io/package/npm/@or-sdk/notifications) | npm | 1.7.5, 1.7.6, 1.7.7 |
| [@or-sdk/password](https://dependencywatch.io/package/npm/@or-sdk/password) | npm | 1.3.6, 1.3.7, 1.3.8 |
| [@or-sdk/payments](https://dependencywatch.io/package/npm/@or-sdk/payments) | npm | 3.2.5, 3.2.6, 3.2.7 |
| [@or-sdk/permissions](https://dependencywatch.io/package/npm/@or-sdk/permissions) | npm | 2.8.1, 2.8.2, 2.8.3 |
| [@or-sdk/permissions-cli](https://dependencywatch.io/package/npm/@or-sdk/permissions-cli) | npm | 1.4.1, 1.4.2, 1.4.3 |
| [@or-sdk/permissions-lambda](https://dependencywatch.io/package/npm/@or-sdk/permissions-lambda) | npm | 2.5.1, 2.5.2, 2.5.3 |
| [@or-sdk/pgsql](https://dependencywatch.io/package/npm/@or-sdk/pgsql) | npm | 1.5.1, 1.5.2, 1.5.3 |
| [@or-sdk/providers](https://dependencywatch.io/package/npm/@or-sdk/providers) | npm | 0.3.6, 0.3.7, 0.3.8 |
| [@or-sdk/qna](https://dependencywatch.io/package/npm/@or-sdk/qna) | npm | 3.4.2, 3.4.3, 3.4.4 |
| [@or-sdk/queue-manager](https://dependencywatch.io/package/npm/@or-sdk/queue-manager) | npm | 1.4.6, 1.4.7, 1.4.8 |
| [@or-sdk/sdk-api](https://dependencywatch.io/package/npm/@or-sdk/sdk-api) | npm | 0.29.2, 0.29.3, 0.29.4 |
| [@or-sdk/settings](https://dependencywatch.io/package/npm/@or-sdk/settings) | npm | 0.25.6, 0.25.7, 0.25.8 |
| [@or-sdk/sku-builder](https://dependencywatch.io/package/npm/@or-sdk/sku-builder) | npm | 2.5.1, 2.5.2, 2.5.3 |
| [@or-sdk/source](https://dependencywatch.io/package/npm/@or-sdk/source) | npm | 2.1.5, 2.1.6, 2.1.7 |
| [@or-sdk/source-api](https://dependencywatch.io/package/npm/@or-sdk/source-api) | npm | 1.1.1, 1.1.2, 1.1.3 |
| [@or-sdk/step-templates](https://dependencywatch.io/package/npm/@or-sdk/step-templates) | npm | 2.2.5, 2.2.6, 2.2.7 |
| [@or-sdk/store](https://dependencywatch.io/package/npm/@or-sdk/store) | npm | 2.1.5, 2.1.6, 2.1.7 |
| [@or-sdk/tables](https://dependencywatch.io/package/npm/@or-sdk/tables) | npm | 0.28.5, 0.28.6, 0.28.7 |
| [@or-sdk/tags](https://dependencywatch.io/package/npm/@or-sdk/tags) | npm | 1.1.5, 1.1.6, 1.1.7 |
| [@or-sdk/tickets](https://dependencywatch.io/package/npm/@or-sdk/tickets) | npm | 1.9.5, 1.9.6, 1.9.7 |
| [@or-sdk/transcripts](https://dependencywatch.io/package/npm/@or-sdk/transcripts) | npm | 1.2.5, 1.2.6, 1.2.7 |
| [@or-sdk/users](https://dependencywatch.io/package/npm/@or-sdk/users) | npm | 3.8.1, 3.8.2, 3.8.3 |
| [@or-sdk/view-templates](https://dependencywatch.io/package/npm/@or-sdk/view-templates) | npm | 2.2.5, 2.2.6, 2.2.7 |
| [@or-sdk/views](https://dependencywatch.io/package/npm/@or-sdk/views) | npm | 3.1.5, 3.1.6, 3.1.7 |
| [@or-sdk/web-search](https://dependencywatch.io/package/npm/@or-sdk/web-search) | npm | 0.6.1, 0.6.2, 0.6.3 |
| [@ornikar/apollo-link-timeout](https://dependencywatch.io/package/npm/@ornikar/apollo-link-timeout) | npm | 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.4.10, 1.4.11 |
| [@ornikar/babel-preset-base](https://dependencywatch.io/package/npm/@ornikar/babel-preset-base) | npm | 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14 |
| [@ornikar/babel-preset-kitt-universal](https://dependencywatch.io/package/npm/@ornikar/babel-preset-kitt-universal) | npm | 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.0.11, 8.0.12 |
| [@ornikar/babel-preset-react](https://dependencywatch.io/package/npm/@ornikar/babel-preset-react) | npm | 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14 |
| [@ornikar/browserslist-config](https://dependencywatch.io/package/npm/@ornikar/browserslist-config) | npm | 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.0.11 |
| [@ornikar/commitlint-config](https://dependencywatch.io/package/npm/@ornikar/commitlint-config) | npm | 8.3.2, 8.3.3, 8.3.4, 8.3.5, 8.3.6, 8.3.7, 8.3.8, 8.3.9, 8.3.10, 8.3.11, 8.3.12 |
| [@ornikar/eslint-config](https://dependencywatch.io/package/npm/@ornikar/eslint-config) | npm | 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10, 24.0.11, 24.0.12 |
| [@ornikar/eslint-config-babel](https://dependencywatch.io/package/npm/@ornikar/eslint-config-babel) | npm | 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10, 24.0.11, 24.0.12 |
| [@ornikar/eslint-config-babel-use](https://dependencywatch.io/package/npm/@ornikar/eslint-config-babel-use) | npm | 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10, 13.2.11, 13.2.12 |
| [@ornikar/eslint-config-formatjs](https://dependencywatch.io/package/npm/@ornikar/eslint-config-formatjs) | npm | 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10 |
| [@ornikar/eslint-config-node](https://dependencywatch.io/package/npm/@ornikar/eslint-config-node) | npm | 12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10 |
| [@ornikar/eslint-config-react](https://dependencywatch.io/package/npm/@ornikar/eslint-config-react) | npm | 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10, 24.0.11 |
| [@ornikar/eslint-config-typescript](https://dependencywatch.io/package/npm/@ornikar/eslint-config-typescript) | npm | 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10 |
| [@ornikar/eslint-config-typescript-nestjs](https://dependencywatch.io/package/npm/@ornikar/eslint-config-typescript-nestjs) | npm | 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10, 24.0.11 |
| [@ornikar/eslint-config-typescript-react](https://dependencywatch.io/package/npm/@ornikar/eslint-config-typescript-react) | npm | 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10, 24.0.11 |
| [@ornikar/eslint-plugin-neverthrow](https://dependencywatch.io/package/npm/@ornikar/eslint-plugin-neverthrow) | npm | 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.3.10, 1.3.11, 1.3.12 |
| [@ornikar/eslint-plugin-ornikar](https://dependencywatch.io/package/npm/@ornikar/eslint-plugin-ornikar) | npm | 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10, 24.0.11 |
| [@ornikar/graphql-config](https://dependencywatch.io/package/npm/@ornikar/graphql-config) | npm | 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11 |
| [@ornikar/intl-config](https://dependencywatch.io/package/npm/@ornikar/intl-config) | npm | 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 10.0.10 |
| [@ornikar/jest-config](https://dependencywatch.io/package/npm/@ornikar/jest-config) | npm | 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13 |
| [@ornikar/jest-config-react](https://dependencywatch.io/package/npm/@ornikar/jest-config-react) | npm | 18.0.2, 18.0.3, 18.0.4, 18.0.5, 18.0.6, 18.0.7, 18.0.8, 18.0.9, 18.0.10, 18.0.11 |
| [@ornikar/jest-config-react-native](https://dependencywatch.io/package/npm/@ornikar/jest-config-react-native) | npm | 17.0.2, 17.0.3, 17.0.4, 17.0.5, 17.0.6, 17.0.7, 17.0.8, 17.0.9, 17.0.10, 17.0.11, 17.0.12 |
| [@ornikar/jest-config-react-native-web](https://dependencywatch.io/package/npm/@ornikar/jest-config-react-native-web) | npm | 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.0.7, 12.0.8, 12.0.9, 12.0.10, 12.0.11, 12.0.12, 12.0.13 |
| [@ornikar/kitt2](https://dependencywatch.io/package/npm/@ornikar/kitt2) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11 |
| [@ornikar/lerna-config](https://dependencywatch.io/package/npm/@ornikar/lerna-config) | npm | 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9, 11.0.10, 11.0.11 |
| [@ornikar/monorepo-config](https://dependencywatch.io/package/npm/@ornikar/monorepo-config) | npm | 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.3.6, 14.3.7, 14.3.8, 14.3.9, 14.3.10, 14.3.11, 14.3.12, 14.3.13 |
| [@ornikar/postcss-config](https://dependencywatch.io/package/npm/@ornikar/postcss-config) | npm | 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.1.10, 9.1.11, 9.1.12 |
| [@ornikar/prettier-config](https://dependencywatch.io/package/npm/@ornikar/prettier-config) | npm | 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11 |
| [@ornikar/prismic-components](https://dependencywatch.io/package/npm/@ornikar/prismic-components) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.12 |
| [@ornikar/react-modern-calendar-datepicker](https://dependencywatch.io/package/npm/@ornikar/react-modern-calendar-datepicker) | npm | 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.2.10, 3.2.11 |
| [@ornikar/react-native-svg-transformer](https://dependencywatch.io/package/npm/@ornikar/react-native-svg-transformer) | npm | 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13 |
| [@ornikar/renovate-config](https://dependencywatch.io/package/npm/@ornikar/renovate-config) | npm | 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11, 9.0.12, 9.0.13 |
| [@ornikar/repo-config](https://dependencywatch.io/package/npm/@ornikar/repo-config) | npm | 15.3.3, 15.3.4, 15.3.5, 15.3.6, 15.3.7, 15.3.8, 15.3.9, 15.3.10, 15.3.11, 15.3.12, 15.3.13 |
| [@ornikar/repo-config-react](https://dependencywatch.io/package/npm/@ornikar/repo-config-react) | npm | 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.0.15, 13.0.16, 13.0.17, 13.0.18, 13.0.19 |
| [@ornikar/repo-config-react-legacy-css](https://dependencywatch.io/package/npm/@ornikar/repo-config-react-legacy-css) | npm | 15.1.2, 15.1.3, 15.1.4, 15.1.5, 15.1.6, 15.1.7, 15.1.8, 15.1.9, 15.1.10, 15.1.11, 15.1.12, 15.1.13 |
| [@ornikar/rollup-config](https://dependencywatch.io/package/npm/@ornikar/rollup-config) | npm | 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.1.9, 11.1.10, 11.1.11, 11.1.12, 11.1.13 |
| [@ornikar/rollup-plugin-postcss](https://dependencywatch.io/package/npm/@ornikar/rollup-plugin-postcss) | npm | 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15 |
| [@ornikar/slate-react-fork](https://dependencywatch.io/package/npm/@ornikar/slate-react-fork) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11 |
| [@ornikar/storybook-config](https://dependencywatch.io/package/npm/@ornikar/storybook-config) | npm | 12.1.2, 12.1.3, 12.1.4, 12.1.5, 12.1.6, 12.1.7, 12.1.8, 12.1.9, 12.1.10 |
| [@ornikar/stylelint-config](https://dependencywatch.io/package/npm/@ornikar/stylelint-config) | npm | 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.12, 14.0.13 |
| [@ornikar/typed-css-modules-loader](https://dependencywatch.io/package/npm/@ornikar/typed-css-modules-loader) | npm | 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10, 0.8.11, 0.8.12 |
| [@ornikar/webpack-config](https://dependencywatch.io/package/npm/@ornikar/webpack-config) | npm | 12.0.2, 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.0.7, 12.0.8, 12.0.9, 12.0.10, 12.0.11, 12.0.12 |
| [@picsart/ai-sdk](https://dependencywatch.io/package/npm/@picsart/ai-sdk) | npm | 3.32.2 |
| [@picsart/gen-ai](https://dependencywatch.io/package/npm/@picsart/gen-ai) | npm | 2.55.11 |
| [@qlik/api](https://dependencywatch.io/package/npm/@qlik/api) | npm | 2.14.2 |
| [@qlik/browserslist-config](https://dependencywatch.io/package/npm/@qlik/browserslist-config) | npm | 3.0.2 |
| [@qlik/carbon-core](https://dependencywatch.io/package/npm/@qlik/carbon-core) | npm | 2.1.1 |
| [@qlik/carboncopy](https://dependencywatch.io/package/npm/@qlik/carboncopy) | npm | 1.1.6 |
| [@qlik/design-tokens](https://dependencywatch.io/package/npm/@qlik/design-tokens) | npm | 1.3.13 |
| [@qlik/dts-bundler](https://dependencywatch.io/package/npm/@qlik/dts-bundler) | npm | 2.0.3 |
| [@qlik/embed-react](https://dependencywatch.io/package/npm/@qlik/embed-react) | npm | 2.5.3 |
| [@qlik/embed-runtime](https://dependencywatch.io/package/npm/@qlik/embed-runtime) | npm | 1.6.4 |
| [@qlik/embed-svelte](https://dependencywatch.io/package/npm/@qlik/embed-svelte) | npm | 1.1.4 |
| [@qlik/embed-web-components](https://dependencywatch.io/package/npm/@qlik/embed-web-components) | npm | 1.7.3 |
| [@qlik/eslint-config](https://dependencywatch.io/package/npm/@qlik/eslint-config) | npm | 2.0.20 |
| [@qlik/eslint-config-base](https://dependencywatch.io/package/npm/@qlik/eslint-config-base) | npm | 0.1.1 |
| [@qlik/eslint-config-react](https://dependencywatch.io/package/npm/@qlik/eslint-config-react) | npm | 0.1.1 |
| [@qlik/eslint-config-svelte](https://dependencywatch.io/package/npm/@qlik/eslint-config-svelte) | npm | 0.1.1 |
| [@qlik/eslint-config-vue](https://dependencywatch.io/package/npm/@qlik/eslint-config-vue) | npm | 0.1.1 |
| [@qlik/nebula-table-utils](https://dependencywatch.io/package/npm/@qlik/nebula-table-utils) | npm | 2.6.9 |
| [@qlik/oxfmt-config](https://dependencywatch.io/package/npm/@qlik/oxfmt-config) | npm | 0.1.6 |
| [@qlik/oxlint-config](https://dependencywatch.io/package/npm/@qlik/oxlint-config) | npm | 0.7.2 |
| [@qlik/prettier-config](https://dependencywatch.io/package/npm/@qlik/prettier-config) | npm | 1.0.3 |
| [@qlik/react-native-simple-grid](https://dependencywatch.io/package/npm/@qlik/react-native-simple-grid) | npm | 1.5.5 |
| [@qlik/runtime-module-loader](https://dependencywatch.io/package/npm/@qlik/runtime-module-loader) | npm | 1.5.1 |
| [@qlik/sdk](https://dependencywatch.io/package/npm/@qlik/sdk) | npm | 0.28.1 |
| [@qlik/sprout-design-docs](https://dependencywatch.io/package/npm/@qlik/sprout-design-docs) | npm | 1.0.2 |
| [@qlik/sprout-gesture](https://dependencywatch.io/package/npm/@qlik/sprout-gesture) | npm | 0.0.13 |
| [@qlik/sprout-icons](https://dependencywatch.io/package/npm/@qlik/sprout-icons) | npm | 0.12.3 |
| [@qlik/sprout-react](https://dependencywatch.io/package/npm/@qlik/sprout-react) | npm | 6.45.3 |
| [@qlik/sprout-react-table](https://dependencywatch.io/package/npm/@qlik/sprout-react-table) | npm | 0.16.7 |
| [@qlik/tsconfig](https://dependencywatch.io/package/npm/@qlik/tsconfig) | npm | 1.0.3 |
| [@servicetitan/acquisition-functions](https://dependencywatch.io/package/npm/@servicetitan/acquisition-functions) | npm | 5.22.1, 5.22.2, 5.22.3, 5.22.4, 5.22.5, 5.22.6, 5.22.7 |
| [@servicetitan/admin-layout](https://dependencywatch.io/package/npm/@servicetitan/admin-layout) | npm | 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9 |
| [@servicetitan/admin-sql-table](https://dependencywatch.io/package/npm/@servicetitan/admin-sql-table) | npm | 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20 |
| [@servicetitan/ajax-handlers](https://dependencywatch.io/package/npm/@servicetitan/ajax-handlers) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/anvil-css-utilities](https://dependencywatch.io/package/npm/@servicetitan/anvil-css-utilities) | npm | 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10 |
| [@servicetitan/anvil-fonts](https://dependencywatch.io/package/npm/@servicetitan/anvil-fonts) | npm | 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10 |
| [@servicetitan/anvil-icon](https://dependencywatch.io/package/npm/@servicetitan/anvil-icon) | npm | 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7 |
| [@servicetitan/anvil-icons](https://dependencywatch.io/package/npm/@servicetitan/anvil-icons) | npm | 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10 |
| [@servicetitan/anvil-react](https://dependencywatch.io/package/npm/@servicetitan/anvil-react) | npm | 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8, 0.11.9 |
| [@servicetitan/anvil-themes](https://dependencywatch.io/package/npm/@servicetitan/anvil-themes) | npm | 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10 |
| [@servicetitan/anvil-token](https://dependencywatch.io/package/npm/@servicetitan/anvil-token) | npm | 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7 |
| [@servicetitan/anvil2](https://dependencywatch.io/package/npm/@servicetitan/anvil2) | npm | 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7 |
| [@servicetitan/anvil2-codemods](https://dependencywatch.io/package/npm/@servicetitan/anvil2-codemods) | npm | 0.11.2, 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8 |
| [@servicetitan/anvil2-ext-atlas](https://dependencywatch.io/package/npm/@servicetitan/anvil2-ext-atlas) | npm | 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8 |
| [@servicetitan/anvil2-ext-charts](https://dependencywatch.io/package/npm/@servicetitan/anvil2-ext-charts) | npm | 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10 |
| [@servicetitan/anvil2-ext-common](https://dependencywatch.io/package/npm/@servicetitan/anvil2-ext-common) | npm | 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7 |
| [@servicetitan/anvil2-ext-mwv](https://dependencywatch.io/package/npm/@servicetitan/anvil2-ext-mwv) | npm | 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11 |
| [@servicetitan/anvil2-illustrations](https://dependencywatch.io/package/npm/@servicetitan/anvil2-illustrations) | npm | 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8 |
| [@servicetitan/anvil2-mcp](https://dependencywatch.io/package/npm/@servicetitan/anvil2-mcp) | npm | 0.0.9, 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15 |
| [@servicetitan/assist-ui](https://dependencywatch.io/package/npm/@servicetitan/assist-ui) | npm | 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7 |
| [@servicetitan/assist-utils](https://dependencywatch.io/package/npm/@servicetitan/assist-utils) | npm | 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8 |
| [@servicetitan/carto-charts-core](https://dependencywatch.io/package/npm/@servicetitan/carto-charts-core) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8 |
| [@servicetitan/carto-charts-react](https://dependencywatch.io/package/npm/@servicetitan/carto-charts-react) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8 |
| [@servicetitan/carto-charts-rn](https://dependencywatch.io/package/npm/@servicetitan/carto-charts-rn) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8 |
| [@servicetitan/carto-react-kit](https://dependencywatch.io/package/npm/@servicetitan/carto-react-kit) | npm | 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10 |
| [@servicetitan/carto-rn-kit](https://dependencywatch.io/package/npm/@servicetitan/carto-rn-kit) | npm | 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16 |
| [@servicetitan/carto-tokens](https://dependencywatch.io/package/npm/@servicetitan/carto-tokens) | npm | 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7 |
| [@servicetitan/component-usage](https://dependencywatch.io/package/npm/@servicetitan/component-usage) | npm | 28.5.1, 28.5.2, 28.5.3, 28.5.4, 28.5.5, 28.5.6, 28.5.7 |
| [@servicetitan/confirm](https://dependencywatch.io/package/npm/@servicetitan/confirm) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/confirm-navigation](https://dependencywatch.io/package/npm/@servicetitan/confirm-navigation) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/contentful](https://dependencywatch.io/package/npm/@servicetitan/contentful) | npm | 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9 |
| [@servicetitan/contentful-proxy](https://dependencywatch.io/package/npm/@servicetitan/contentful-proxy) | npm | 1.1.12, 1.1.13, 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.18 |
| [@servicetitan/cp-api](https://dependencywatch.io/package/npm/@servicetitan/cp-api) | npm | 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7 |
| [@servicetitan/cp-mfe](https://dependencywatch.io/package/npm/@servicetitan/cp-mfe) | npm | 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7 |
| [@servicetitan/cp-mfe-dev](https://dependencywatch.io/package/npm/@servicetitan/cp-mfe-dev) | npm | 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7 |
| [@servicetitan/cp-react-hooks](https://dependencywatch.io/package/npm/@servicetitan/cp-react-hooks) | npm | 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7 |
| [@servicetitan/cp-ui](https://dependencywatch.io/package/npm/@servicetitan/cp-ui) | npm | 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7 |
| [@servicetitan/culture](https://dependencywatch.io/package/npm/@servicetitan/culture) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/data-query](https://dependencywatch.io/package/npm/@servicetitan/data-query) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/datadog-rum](https://dependencywatch.io/package/npm/@servicetitan/datadog-rum) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/datetime-utils](https://dependencywatch.io/package/npm/@servicetitan/datetime-utils) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/design-system](https://dependencywatch.io/package/npm/@servicetitan/design-system) | npm | 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10 |
| [@servicetitan/docs-anvil-uikit-contrib](https://dependencywatch.io/package/npm/@servicetitan/docs-anvil-uikit-contrib) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/docs-uikit](https://dependencywatch.io/package/npm/@servicetitan/docs-uikit) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/document-title](https://dependencywatch.io/package/npm/@servicetitan/document-title) | npm | 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7 |
| [@servicetitan/dte-pdf-editor](https://dependencywatch.io/package/npm/@servicetitan/dte-pdf-editor) | npm | 1.76.1, 1.76.2, 1.76.3, 1.76.4, 1.76.5, 1.76.6, 1.76.7 |
| [@servicetitan/dte-unlayer](https://dependencywatch.io/package/npm/@servicetitan/dte-unlayer) | npm | 0.150.1, 0.150.2, 0.150.3, 0.150.4, 0.150.5, 0.150.6, 0.150.7 |
| [@servicetitan/eh-module-communication](https://dependencywatch.io/package/npm/@servicetitan/eh-module-communication) | npm | 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7 |
| [@servicetitan/error-boundary](https://dependencywatch.io/package/npm/@servicetitan/error-boundary) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/eslint-config](https://dependencywatch.io/package/npm/@servicetitan/eslint-config) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/eslint-plugin](https://dependencywatch.io/package/npm/@servicetitan/eslint-plugin) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/eslint-plugin-decorators-declare](https://dependencywatch.io/package/npm/@servicetitan/eslint-plugin-decorators-declare) | npm | 12.8.15, 12.8.16, 12.8.17, 12.8.18, 12.8.19, 12.8.20, 12.8.21 |
| [@servicetitan/eslint-plugin-folder-schema](https://dependencywatch.io/package/npm/@servicetitan/eslint-plugin-folder-schema) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/eslint-plugin-mobx-6](https://dependencywatch.io/package/npm/@servicetitan/eslint-plugin-mobx-6) | npm | 12.8.15, 12.8.16, 12.8.17, 12.8.18, 12.8.19, 12.8.20 |
| [@servicetitan/eslint-plugin-processors-stub](https://dependencywatch.io/package/npm/@servicetitan/eslint-plugin-processors-stub) | npm | 12.8.15, 12.8.16, 12.8.17, 12.8.18, 12.8.19, 12.8.20, 12.8.21 |
| [@servicetitan/examples](https://dependencywatch.io/package/npm/@servicetitan/examples) | npm | 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11 |
| [@servicetitan/feature-spotlight](https://dependencywatch.io/package/npm/@servicetitan/feature-spotlight) | npm | 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7 |
| [@servicetitan/folder-lint](https://dependencywatch.io/package/npm/@servicetitan/folder-lint) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/forge](https://dependencywatch.io/package/npm/@servicetitan/forge) | npm | 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7 |
| [@servicetitan/form](https://dependencywatch.io/package/npm/@servicetitan/form) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/form-state](https://dependencywatch.io/package/npm/@servicetitan/form-state) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/grid](https://dependencywatch.io/package/npm/@servicetitan/grid) | npm | 0.0.63, 0.0.64, 0.0.65, 0.0.66, 0.0.67, 0.0.68, 0.0.69 |
| [@servicetitan/hammer-icon](https://dependencywatch.io/package/npm/@servicetitan/hammer-icon) | npm | 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7 |
| [@servicetitan/hammer-react](https://dependencywatch.io/package/npm/@servicetitan/hammer-react) | npm | 1.42.2, 1.42.3, 1.42.4, 1.42.5, 1.42.6, 1.42.7, 1.42.8 |
| [@servicetitan/hammer-token](https://dependencywatch.io/package/npm/@servicetitan/hammer-token) | npm | 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7 |
| [@servicetitan/hash-browser-router](https://dependencywatch.io/package/npm/@servicetitan/hash-browser-router) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/help-center](https://dependencywatch.io/package/npm/@servicetitan/help-center) | npm | 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14 |
| [@servicetitan/html-sketchapp](https://dependencywatch.io/package/npm/@servicetitan/html-sketchapp) | npm | 4.2.8, 4.2.9, 4.2.10, 4.2.11, 4.2.12, 4.2.13, 4.2.14 |
| [@servicetitan/install](https://dependencywatch.io/package/npm/@servicetitan/install) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/intl](https://dependencywatch.io/package/npm/@servicetitan/intl) | npm | 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7 |
| [@servicetitan/json-render-react](https://dependencywatch.io/package/npm/@servicetitan/json-render-react) | npm | 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.4.10, 0.4.11, 0.4.12 |
| [@servicetitan/kendo-theme](https://dependencywatch.io/package/npm/@servicetitan/kendo-theme) | npm | 0.0.27, 0.0.28, 0.0.29, 0.0.30, 0.0.31, 0.0.32, 0.0.33 |
| [@servicetitan/ko-bridge](https://dependencywatch.io/package/npm/@servicetitan/ko-bridge) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/launchdarkly-service](https://dependencywatch.io/package/npm/@servicetitan/launchdarkly-service) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/lazy-module](https://dependencywatch.io/package/npm/@servicetitan/lazy-module) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/ld-type-generator](https://dependencywatch.io/package/npm/@servicetitan/ld-type-generator) | npm | 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7 |
| [@servicetitan/line-item-editor](https://dependencywatch.io/package/npm/@servicetitan/line-item-editor) | npm | 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7 |
| [@servicetitan/link-item](https://dependencywatch.io/package/npm/@servicetitan/link-item) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/log-service](https://dependencywatch.io/package/npm/@servicetitan/log-service) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/marketing-direct-mail-components](https://dependencywatch.io/package/npm/@servicetitan/marketing-direct-mail-components) | npm | 20.1.1, 20.1.2, 20.1.3, 20.1.4, 20.1.5, 20.1.6, 20.1.7 |
| [@servicetitan/marketing-email-components](https://dependencywatch.io/package/npm/@servicetitan/marketing-email-components) | npm | 20.2.3, 20.2.4, 20.2.5, 20.2.6, 20.2.7, 20.2.8, 20.2.9 |
| [@servicetitan/marketing-form](https://dependencywatch.io/package/npm/@servicetitan/marketing-form) | npm | 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8 |
| [@servicetitan/marketing-global-route](https://dependencywatch.io/package/npm/@servicetitan/marketing-global-route) | npm | 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.14.6, 1.14.7 |
| [@servicetitan/marketing-integration-widgets](https://dependencywatch.io/package/npm/@servicetitan/marketing-integration-widgets) | npm | 1.0.40, 1.0.41, 1.0.42, 1.0.43, 1.0.44, 1.0.45, 1.0.46 |
| [@servicetitan/marketing-route](https://dependencywatch.io/package/npm/@servicetitan/marketing-route) | npm | 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7 |
| [@servicetitan/marketing-ui](https://dependencywatch.io/package/npm/@servicetitan/marketing-ui) | npm | 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7 |
| [@servicetitan/marketing-widgets](https://dependencywatch.io/package/npm/@servicetitan/marketing-widgets) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7 |
| [@servicetitan/measure-sheet-data](https://dependencywatch.io/package/npm/@servicetitan/measure-sheet-data) | npm | 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7 |
| [@servicetitan/mfe-quick-actions](https://dependencywatch.io/package/npm/@servicetitan/mfe-quick-actions) | npm | 0.5.49, 0.5.50, 0.5.51, 0.5.52, 0.5.53, 0.5.54, 0.5.55 |
| [@servicetitan/micro-frontend](https://dependencywatch.io/package/npm/@servicetitan/micro-frontend) | npm | 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10 |
| [@servicetitan/microfront](https://dependencywatch.io/package/npm/@servicetitan/microfront) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8 |
| [@servicetitan/microfront-auth](https://dependencywatch.io/package/npm/@servicetitan/microfront-auth) | npm | 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11 |
| [@servicetitan/microfront-tests](https://dependencywatch.io/package/npm/@servicetitan/microfront-tests) | npm | 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17 |
| [@servicetitan/microfront-utils](https://dependencywatch.io/package/npm/@servicetitan/microfront-utils) | npm | 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7 |
| [@servicetitan/modularpayments-webfields](https://dependencywatch.io/package/npm/@servicetitan/modularpayments-webfields) | npm | 1.0.53, 1.0.54, 1.0.55, 1.0.56, 1.0.57, 1.0.58, 1.0.59 |
| [@servicetitan/moneyout-api-client](https://dependencywatch.io/package/npm/@servicetitan/moneyout-api-client) | npm | 1.29.1, 1.29.2, 1.29.3, 1.29.4, 1.29.5, 1.29.6, 1.29.7 |
| [@servicetitan/mpa-components](https://dependencywatch.io/package/npm/@servicetitan/mpa-components) | npm | 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7 |
| [@servicetitan/navigation](https://dependencywatch.io/package/npm/@servicetitan/navigation) | npm | 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7 |
| [@servicetitan/notifications](https://dependencywatch.io/package/npm/@servicetitan/notifications) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/onboarding-ui](https://dependencywatch.io/package/npm/@servicetitan/onboarding-ui) | npm | 18.5.1, 18.5.2, 18.5.3, 18.5.4, 18.5.5, 18.5.6, 18.5.7 |
| [@servicetitan/quick-actions](https://dependencywatch.io/package/npm/@servicetitan/quick-actions) | npm | 1.15.2, 1.15.3, 1.15.4, 1.15.5, 1.15.6, 1.15.7, 1.15.8 |
| [@servicetitan/react-hooks](https://dependencywatch.io/package/npm/@servicetitan/react-hooks) | npm | 7.7.1, 7.7.2, 7.7.3, 7.7.4, 7.7.5, 7.7.6, 7.7.7 |
| [@servicetitan/react-ioc](https://dependencywatch.io/package/npm/@servicetitan/react-ioc) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/responsive](https://dependencywatch.io/package/npm/@servicetitan/responsive) | npm | 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7 |
| [@servicetitan/restrict-imports](https://dependencywatch.io/package/npm/@servicetitan/restrict-imports) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/schema-comparison](https://dependencywatch.io/package/npm/@servicetitan/schema-comparison) | npm | 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9 |
| [@servicetitan/skeleton](https://dependencywatch.io/package/npm/@servicetitan/skeleton) | npm | 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10 |
| [@servicetitan/standalone-core-feature-gates](https://dependencywatch.io/package/npm/@servicetitan/standalone-core-feature-gates) | npm | 1.11.4, 1.11.5, 1.11.6, 1.11.7, 1.11.8, 1.11.9, 1.11.10 |
| [@servicetitan/standalone-feature-flags](https://dependencywatch.io/package/npm/@servicetitan/standalone-feature-flags) | npm | 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8 |
| [@servicetitan/standalone-root](https://dependencywatch.io/package/npm/@servicetitan/standalone-root) | npm | 1.11.3, 1.11.4, 1.11.5, 1.11.6, 1.11.7, 1.11.8, 1.11.9 |
| [@servicetitan/standalone-tm-api](https://dependencywatch.io/package/npm/@servicetitan/standalone-tm-api) | npm | 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7 |
| [@servicetitan/standalone-ui](https://dependencywatch.io/package/npm/@servicetitan/standalone-ui) | npm | 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10 |
| [@servicetitan/startup](https://dependencywatch.io/package/npm/@servicetitan/startup) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/startup-jest](https://dependencywatch.io/package/npm/@servicetitan/startup-jest) | npm | 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7 |
| [@servicetitan/startup-mfe-compat](https://dependencywatch.io/package/npm/@servicetitan/startup-mfe-compat) | npm | 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7 |
| [@servicetitan/startup-utils](https://dependencywatch.io/package/npm/@servicetitan/startup-utils) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/stylelint-config](https://dependencywatch.io/package/npm/@servicetitan/stylelint-config) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/suppress-warnings](https://dependencywatch.io/package/npm/@servicetitan/suppress-warnings) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/table](https://dependencywatch.io/package/npm/@servicetitan/table) | npm | 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7 |
| [@servicetitan/tanstack-query-mobx](https://dependencywatch.io/package/npm/@servicetitan/tanstack-query-mobx) | npm | 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7 |
| [@servicetitan/temporal-lite](https://dependencywatch.io/package/npm/@servicetitan/temporal-lite) | npm | 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7 |
| [@servicetitan/testing-library](https://dependencywatch.io/package/npm/@servicetitan/testing-library) | npm | 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7 |
| [@servicetitan/thoughtspot-theme](https://dependencywatch.io/package/npm/@servicetitan/thoughtspot-theme) | npm | 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7 |
| [@servicetitan/time-zones](https://dependencywatch.io/package/npm/@servicetitan/time-zones) | npm | 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7 |
| [@servicetitan/titan-chat-ui](https://dependencywatch.io/package/npm/@servicetitan/titan-chat-ui) | npm | 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9 |
| [@servicetitan/titan-chat-ui-anvil2](https://dependencywatch.io/package/npm/@servicetitan/titan-chat-ui-anvil2) | npm | 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7 |
| [@servicetitan/titan-chat-ui-common](https://dependencywatch.io/package/npm/@servicetitan/titan-chat-ui-common) | npm | 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7 |
| [@servicetitan/titan-chat-ui-cypress](https://dependencywatch.io/package/npm/@servicetitan/titan-chat-ui-cypress) | npm | 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9 |
| [@servicetitan/titan-chatbot-api](https://dependencywatch.io/package/npm/@servicetitan/titan-chatbot-api) | npm | 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7 |
| [@servicetitan/titan-chatbot-client](https://dependencywatch.io/package/npm/@servicetitan/titan-chatbot-client) | npm | 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9 |
| [@servicetitan/titan-chatbot-ui](https://dependencywatch.io/package/npm/@servicetitan/titan-chatbot-ui) | npm | 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9 |
| [@servicetitan/titan-chatbot-ui-anvil2](https://dependencywatch.io/package/npm/@servicetitan/titan-chatbot-ui-anvil2) | npm | 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7 |
| [@servicetitan/titan-chatbot-ui-cypress](https://dependencywatch.io/package/npm/@servicetitan/titan-chatbot-ui-cypress) | npm | 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7 |
| [@servicetitan/tokens](https://dependencywatch.io/package/npm/@servicetitan/tokens) | npm | 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7 |
| [@servicetitan/toolbelt-shared-registry](https://dependencywatch.io/package/npm/@servicetitan/toolbelt-shared-registry) | npm | 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.14.6, 1.14.7 |
| [@servicetitan/uikit-docs](https://dependencywatch.io/package/npm/@servicetitan/uikit-docs) | npm | 22.11.1, 22.11.2, 22.11.3, 22.11.4, 22.11.5, 22.11.6, 22.11.7 |
| [@servicetitan/unit-tests](https://dependencywatch.io/package/npm/@servicetitan/unit-tests) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8 |
| [@servicetitan/va-mfe-loader](https://dependencywatch.io/package/npm/@servicetitan/va-mfe-loader) | npm | 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7 |
| [@servicetitan/web-components](https://dependencywatch.io/package/npm/@servicetitan/web-components) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7 |
| [@servicetitan/widget-platform](https://dependencywatch.io/package/npm/@servicetitan/widget-platform) | npm | 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7 |
| [@servicetitan/widget-platform-monolith](https://dependencywatch.io/package/npm/@servicetitan/widget-platform-monolith) | npm | 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7 |
| [@thiennq/docs-viewer](https://dependencywatch.io/package/npm/@thiennq/docs-viewer) | npm | 1.6.2, 1.6.3, 1.6.4 |
| [@umacloud/cli-darwin-arm64](https://dependencywatch.io/package/npm/@umacloud/cli-darwin-arm64) | npm | 1.0.74 |
| [@umacloud/cli-darwin-x64](https://dependencywatch.io/package/npm/@umacloud/cli-darwin-x64) | npm | 1.0.74 |
| [@umacloud/cli-linux-arm64](https://dependencywatch.io/package/npm/@umacloud/cli-linux-arm64) | npm | 1.0.74 |
| [@umacloud/cli-linux-musl-arm64](https://dependencywatch.io/package/npm/@umacloud/cli-linux-musl-arm64) | npm | 1.0.74 |
| [@umacloud/cli-linux-musl-x64](https://dependencywatch.io/package/npm/@umacloud/cli-linux-musl-x64) | npm | 1.0.74 |
| [@umacloud/cli-linux-x64](https://dependencywatch.io/package/npm/@umacloud/cli-linux-x64) | npm | 1.0.74 |
| [@umacloud/cli-win32-x64](https://dependencywatch.io/package/npm/@umacloud/cli-win32-x64) | npm | 1.0.74 |
| [@umacloud/knowledge](https://dependencywatch.io/package/npm/@umacloud/knowledge) | npm | 1.0.74 |
| [@workbench-stack/core](https://dependencywatch.io/package/npm/@workbench-stack/core) | npm | 3.9.8 |
| [babel-plugin-linaria-css-to-undefined](https://dependencywatch.io/package/npm/babel-plugin-linaria-css-to-undefined) | npm | 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9, 0.3.10, 0.3.11, 0.3.12, 0.3.13, 0.3.14, 0.3.15, 0.3.16, 0.3.17 |
| [cache-manager](https://dependencywatch.io/package/npm/cache-manager) | npm | 7.2.10 |
| [cacheable](https://dependencywatch.io/package/npm/cacheable) | npm | 2.5.1 |
| [cacheable-request](https://dependencywatch.io/package/npm/cacheable-request) | npm | 13.0.20 |
| [conv-context-next](https://dependencywatch.io/package/npm/conv-context-next) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10 |
| [ecto](https://dependencywatch.io/package/npm/ecto) | npm | 5.0.1 |
| [editable-contracts](https://dependencywatch.io/package/npm/editable-contracts) | npm | 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 0.0.20, 0.0.21, 0.0.22, 0.0.23, 0.0.24, 0.0.25, 0.0.26, 0.0.27 |
| [eslint-plugin-folder-schema](https://dependencywatch.io/package/npm/eslint-plugin-folder-schema) | npm | 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21 |
| [example-js-project](https://dependencywatch.io/package/npm/example-js-project) | npm | 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11 |
| [file-entry-cache](https://dependencywatch.io/package/npm/file-entry-cache) | npm | 11.1.6 |
| [flat-cache](https://dependencywatch.io/package/npm/flat-cache) | npm | 6.1.24 |
| [folder-lint](https://dependencywatch.io/package/npm/folder-lint) | npm | 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21 |
| [frontend-orb](https://dependencywatch.io/package/npm/frontend-orb) | npm | 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.4.10, 4.4.11, 4.4.12, 4.4.13, 4.4.14, 4.4.15, 4.4.16, 4.4.17, 4.4.18 |
| [hamus.js](https://dependencywatch.io/package/npm/hamus.js) | npm | 0.4.1 |
| [http-metrics-middleware](https://dependencywatch.io/package/npm/http-metrics-middleware) | npm | 2.2.2 |
| [keyv](https://dependencywatch.io/package/npm/keyv) | npm | 6.0.0 |
| [native-frontend-orb](https://dependencywatch.io/package/npm/native-frontend-orb) | npm | 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 1.1.12, 1.1.13, 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.18, 1.1.19 |
| [picasso-plugin-hammer](https://dependencywatch.io/package/npm/picasso-plugin-hammer) | npm | 2.11.6 |
| [picasso-plugin-q](https://dependencywatch.io/package/npm/picasso-plugin-q) | npm | 2.11.6 |
| [picasso.js](https://dependencywatch.io/package/npm/picasso.js) | npm | 2.11.6 |
| [pob-test-package-in-monorepo](https://dependencywatch.io/package/npm/pob-test-package-in-monorepo) | npm | 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.14, 5.2.15, 5.2.16 |
| [pob-test-typescript-package-in-monorepo](https://dependencywatch.io/package/npm/pob-test-typescript-package-in-monorepo) | npm | 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.2.10, 4.2.11, 4.2.12, 4.2.13, 4.2.14, 4.2.15, 4.2.16, 4.2.17 |
| [qlik-chart-modules](https://dependencywatch.io/package/npm/qlik-chart-modules) | npm | 1.1.1 |
| [qlik-modifiers](https://dependencywatch.io/package/npm/qlik-modifiers) | npm | 0.10.1 |
| [qlik-object-conversion](https://dependencywatch.io/package/npm/qlik-object-conversion) | npm | 0.17.2 |
| [rwc-client](https://dependencywatch.io/package/npm/rwc-client) | npm | 0.29.10, 0.29.11, 0.29.12, 0.29.13, 0.29.14, 0.29.15, 0.29.16, 0.29.17, 0.29.18, 0.29.19 |
| [server-hemera-mongo](https://dependencywatch.io/package/npm/server-hemera-mongo) | npm | 0.0.12 |
| [sn-listbox](https://dependencywatch.io/package/npm/sn-listbox) | npm | 0.3.3 |
| [tslint-folder-schema](https://dependencywatch.io/package/npm/tslint-folder-schema) | npm | 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21 |
| [umadev](https://dependencywatch.io/package/npm/umadev) | npm | 1.0.74 |
| [verdaccio-okta-oauth](https://dependencywatch.io/package/npm/verdaccio-okta-oauth) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.8, 38.1.9, 38.1.10, 38.1.11, 38.1.12, 38.1.13, 38.1.14, 38.1.15, 38.1.16 |
| [verdaccio-tarball-local-storage](https://dependencywatch.io/package/npm/verdaccio-tarball-local-storage) | npm | 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.8, 38.1.9, 38.1.10, 38.1.11, 38.1.12, 38.1.13, 38.1.14, 38.1.15, 38.1.16 |
| [workbench-browser-server](https://dependencywatch.io/package/npm/workbench-browser-server) | npm | 0.0.2 |

## What happened

**Refreshed 2026-08-17.** The verified package list is now the full Wiz Research IOC feed (`keyv-packages.csv`): **443 npm packages spanning 2,235 versions** across the compromised maintainers `keyv`/`cacheable` (11 pkgs), `@ornikar/*` (42), Qlik `@nebula.js/*`+`@qlik/*`+`picasso.js`/`sn-listbox`/etc. (58), OneReach `@onereach/*`+`@or-sdk/*` (152), ServiceTitan `@servicetitan/*`+`verdaccio-*`+`folder-lint`-style tooling (149), `@hubsync/web-sdk-react` (27 versions), `@arv-bedrock/*` (5), plus `@adminide-stack/*`, `@picsart/*`, `@thiennq/*`, `@umacloud/*`+`umadev`, `@workbench-stack/*`+`workbench-browser-server`, `@deliveroo/*`, `frontend-orb`, `native-frontend-orb`, `babel-plugin-linaria-css-to-undefined`, `pob-test-*`, `rwc-client`, `server-hemera-mongo`. SafeDep's independent registry-backed telemetry puts the total higher (1,684 versions across 420 names tied to 9 orgs); the Wiz CSV is used here because every row is a checked `package@version` pair. Datadog Security Labs' write-up, Snyk's "Inside the keyv npm Supply Chain Compromise" (03aug-preinstall-malware-trusted-provenance-ide-hooks), and Socket's tracking blog all corroborate the same worm.

On 2026-08-04 an attacker took over the GitHub account of the maintainer behind `keyv` and the wider `cacheable` family, then pushed malicious files directly to `main` and immediately cut releases. Because the releases were built by the project's own GitHub Actions workflow, npm published them **with valid provenance attestations**. This is the detail worth internalising: provenance attests *where a build came from*, not *that the code is safe*. Every automated check that trusts provenance as a proxy for integrity passed these packages.

Every affected package received two new files - `setup.mjs` and `Math_Symbol.js` - plus a `"preinstall": "node setup.mjs"` entry in `package.json`. `setup.mjs` is a heavily obfuscated dropper whose only job is to silently download the Bun runtime (v1.3.13) from `github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/` into `/tmp/bun-dl-*/` and execute the real payload under it. `Math_Symbol.js` is a 728 KB obfuscated blob containing the credential stealers. Running with `--ignore-scripts` blocks it; a normal `npm install` does not.

The stealer harvests npm auth tokens from `.npmrc`, GitHub CLI tokens (classic PATs, session tokens, OIDC), AWS keys from `~/.aws/credentials`, and Vault tokens from `VAULT_TOKEN`. Wiz additionally observed cloud and infrastructure secrets, AI tool configuration files, cryptocurrency wallets, CI/CD secret harvesting, build-runner identification, and cloud environment enumeration. Findings are encrypted and exfiltrated into public GitHub repositories created under compromised identities, carrying the description `Shai-Hulud: Here We Go Again`. Wiz also found the payload planting IDE persistence - `setup.mjs` written into `.claude` and `.vscode` directories - which survives a plain dependency cleanup.

The stolen npm tokens feed the worm. Registry timestamps show how fast it moved: `keyv@6.0.0` landed at 09:35:00 UTC, the first onward hop (`@thiennq/docs-viewer@1.6.2`) at 09:38:13 - three minutes later. The rest of the `cacheable` family went out between 10:10 and 10:15, then 25 `@ornikar/*` packages were published in a single second at 10:19:10, and a Qlik cluster (`@qlik/*`, `@nebula.js/nucleus`, `picasso*`, `http-metrics-middleware`) at 10:46:36. By 11:37 UTC Aikido counted **868 packages across 1,381 versions with over 2 billion combined monthly installs**. The package list below is the verified subset published by Aikido and Wiz, not the full 868.

Wiz assesses the payload as a descendant of the "Mini" Shai-Hulud family, sharing similarities with the [TeamPCP TanStack burst](https://dependencywatch.io/incident/npm-2026-05-shai-hulud-tanstack) and the [@antv wave](https://dependencywatch.io/incident/npm-2026-05-19-antv-mini-shai-hulud), and notes a new intimidation string in the initial commits: `IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients`. Attribution remains open - Wiz Research is still investigating and has not named an actor, so none is recorded here.

## Verification notes

Every `package@version` below was checked against the live npm registry while compiling this entry. All ten packages in the maintainer's own family (`keyv`, `cacheable`, `cache-manager`, `cacheable-request`, `flat-cache`, `file-entry-cache`, `@cacheable/*`, `ecto`) had exactly one version published on 2026-08-04, and **npm has since removed all ten**. The worm-propagated versions were still live at time of writing and each independently confirmed to carry `"preinstall": "node setup.mjs"`. Note that `@or-sdk/invitations` shipped three poisoned releases (`1.4.8`, `1.4.9`, `1.4.10`) - `1.4.10` at 11:55 UTC looks like a remediation attempt but still carries the hook. `@picsart/ai-sdk@3.32.1` was checked and is clean; only `3.32.2` is affected.

## Indicators of compromise

- Exfil domain: `npm-cache[.]com` (104.21.35[.]216, Cloudflare)
- ETH RPC endpoints: `eth-mainnet.nodereal[.]io`, `go.getblock[.]io`, `eth.llamarpc[.]com`
- File artifacts: `/tmp/bun-dl-*/`, `node_modules/keyv/Math_Symbol.js`
- `Math_Symbol.js` / `math_init.js` - SHA1 `35a672cf34b996b91f3e1c28cbf3a05a37e036e4`
- `setup.mjs` in `.claude` - SHA1 `686aa40d0fc22c8d569494543a0f891f359f2f99`
- `setup.mjs` in `.vscode` - SHA1 `f525d52ceb966516686b482d3dc0137028cc6a63`
- GitHub repo description: `Shai-Hulud: Here We Go Again`

## Impact

- npm registry auth tokens harvested from `.npmrc` - used to publish the worm onward
- GitHub CLI tokens: classic PATs, session tokens, and OIDC tokens
- AWS access keys and session tokens from `~/.aws/credentials`
- HashiCorp Vault client tokens from `VAULT_TOKEN`, with an HTTP fallback fetch
- Cloud/infra secrets, AI tool configuration files, and cryptocurrency wallets
- CI/CD secrets, build-runner identification, and cloud environment enumeration
- IDE persistence: `setup.mjs` dropped into `.claude` and `.vscode` so the payload re-runs after cleanup
- Exfiltration to attacker-created public GitHub repos described `Shai-Hulud: Here We Go Again`

## What to do

1. Pin away from every version listed below and reinstall with `--ignore-scripts`; the hook is `preinstall`, so it fires before install completes
2. Audit lockfiles for the exact versions - `keyv@6.0.0`, `flat-cache@6.1.24`, `file-entry-cache@11.1.6` are the highest-blast-radius entries
3. Treat any machine or runner that installed an affected version as compromised and rebuild it
4. Rotate npm tokens, GitHub PATs/OIDC trust, AWS keys, Vault tokens, SSH keys, Kubernetes and Terraform credentials
5. Audit your own npm publish history - stolen tokens were used to push the worm under unrelated maintainers
6. Delete stray `setup.mjs` / `Math_Symbol.js` / `math_init.js` from repos and from `.claude` and `.vscode` directories
7. Search for exfil repos under your GitHub org with the description `Shai-Hulud: Here We Go Again` and revoke their creating tokens
8. Do not treat npm provenance as a safety signal here - these builds were genuinely signed by GitHub Actions

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [Keyv and friends compromised in active Shai-Hulud supply chain attack](https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack) - Aikido Security
- [keyv and cacheable npm package hijacked in supply chain attack](https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack) - Wiz
- [wiz-research-iocs: keyv-packages.csv (affected package/version list, 443 packages / 2,235 versions)](https://github.com/wiz-sec-public/wiz-research-iocs/blob/main/reports/keyv-packages.csv) - Wiz Research
- [Worm compromises hundreds of popular npm packages](https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/) - Datadog Security Labs

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable
Markdown version: https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).