What's Happening?
A significant supply chain compromise has been identified in the npm ecosystem, affecting the widely used keyv and cacheable packages. On August 4, 2026, malicious preinstall hooks were discovered in at least ten packages within these namespaces. The
compromised packages, which include keyv@6.0.0, were found to contain a setup.mjs script that downloads a standalone Bun runtime, executes a second stage, and harvests cloud and CI credentials. The attack has led to the republishing of trojanized versions of other packages using stolen npm tokens. The maintainer account, identified as Jaredwray, was compromised, allowing the threat actor to publish across multiple package families. The attack has resulted in the theft of credentials from cloud services like AWS, GCP, and Azure, as well as GitHub and npm tokens. The malicious packages have been downloaded millions of times, posing a significant risk to developers and organizations relying on these dependencies.
Why It's Important?
This incident highlights the vulnerabilities in the software supply chain, particularly in the npm ecosystem, which is widely used by developers globally. The compromise of keyv and cacheable packages underscores the potential for widespread impact, as these packages are foundational in many dependency trees. The attack not only affects individual developers but also poses a risk to organizations that rely on these packages for their applications. The theft of cloud and CI credentials can lead to unauthorized access to sensitive data and systems, potentially resulting in data breaches and financial losses. This event serves as a critical reminder of the importance of securing software supply chains and implementing robust security measures to detect and mitigate such threats.
What's Next?
Developers and security teams are advised to pin affected packages to versions prior to the compromised ones and rebuild lockfiles. It is recommended to block the entire keyv and cacheable scope in registry proxies or allowlists. Security teams should hunt for and remove any host-level dead-man's switches before rotating credentials. Organizations must audit npm accounts for unexpected package versions and GitHub for newly created repositories and commits. The ongoing investigation by Socket's Threat Research Team will continue to provide updates and technical analysis of the malware and its distribution methods.
