NPM Packages in the Keyv and Cacheable Namespaces Compromised
5 hours ago
- Socket's Threat Research Team is tracking an active supply chain compromise affecting keyv and cacheable npm packages, with ten malicious packages published on August 4, 2026.
- The attack uses a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime, executes obfuscated second stage, harvests cloud/CI credentials, and republishes trojanized versions via stolen npm tokens.
- The maintainer account (Jaredwray) was compromised, and the worm spread to packages outside the keyv/cacheable namespaces using stolen npm tokens and OIDC trusted publishing.
- Credential theft targets AWS, GCP, Azure keys, HashiCorp Vault, Kubernetes tokens, GitHub Actions OIDC, npm tokens, and performs a TruffleHog-style regex sweep for generic secrets.
- Self-propagation: the payload repackages other npm packages with the same hook and republishes them via npm OIDC trusted publishing, turning the attack into a worm.
- Exfiltration: stolen data is committed to threat actor GitHub repositories and delivered to DNS-resolved destinations, with encrypted payloads using AES-256-GCM.
- Persistence includes autostart hooks in .claude and .vscode, plus a host-level dead-man's switch that triggers upon token revocation, executing a remote-supplied command.
- The affected packages have tens of millions of weekly downloads; Socket detected malicious artifacts an average of 5 minutes 18 seconds after publication.
- Mitigation: pin affected packages to previous versions, block entire keyv and cacheable scopes, remove dead-man's switch and implants before rotating credentials, and audit accounts.
- The attack demonstrates that provenance attests build integrity, not source integrity, as the build was trojanized before signing.