Active npm Supply-Chain Attack Compromises Keyv and Cacheable Packages

Aug 4, 2026 · Original article ↗

Summary

A malicious npm preinstall hook in Keyv, Cacheable, and other packages steals developer and CI credentials, spreads by republishing trojanized packages, and installs persistence. The investigation remains ongoing.

Key points

On August 4, 2026, at least ten packages across the Keyv and Cacheable ecosystems—and packages from other maintainers—were published with a malicious preinstall hook.
The loader downloads a standalone Bun runtime to execute an obfuscated payload that harvests cloud, Vault, Kubernetes, GitHub, npm, and CI credentials.
Using stolen credentials and npm OIDC trusted publishing, the payload can inject itself into other packages and publish trojanized versions.
The malware exfiltrates encrypted data through GitHub repositories and DNS-resolved destinations, and can install persistent services that react to token revocation.
Repository hooks in .claude and .vscode can trigger the loader when a developer or AI coding agent opens a cloned repository, without an npm install.
Treat environments that installed affected versions and ran install scripts as compromised; remove the persistence and implant before revoking or rotating exposed credentials.
Socket says the investigation and affected-package list are ongoing; the report notes that valid provenance can attest a build made from already-trojanized source.

Article Details

Attack Vectors: On 2026-08-04, a reportedly compromised Jaredwray maintainer account was used to publish keyv@6.0.0 with a malicious npm preinstall hook. The affected packages named in the article also include @thiennq/docs-viewer@1.6.2 and nine cacheable-family releases.
The preinstall hook runs setup.mjs, which downloads a standalone Bun runtime when needed and uses it to execute the obfuscated Math_Symbol.js payload.
The payload collects credentials from cloud instance metadata, files, environment variables, processes, and the npm registry. It can inject its hook into other packages accessible with stolen npm credentials and republish them.
Stolen findings are committed to threat actor-controlled GitHub repositories or sent encrypted to DNS-resolved destinations. Repository hooks in .claude/settings.json and .vscode/tasks.json can run the loader when a cloned repository is opened, without an npm install.
A host-level token watcher persists through a macOS LaunchAgent or Linux systemd user service. If the stolen GitHub token receives an HTTP 4xx response, the watcher evaluates a remote-supplied handler.
Defensive Notes: Treat environments that installed an affected version with install scripts enabled as compromised. Pin affected packages to earlier versions, rebuild lockfiles, and use exact versions and integrity hashes; consider blocking the affected namespaces while the maintainer account remains compromised.
Find and remove the token watcher, its LaunchAgent or systemd service, the loader and payload files, and the .claude and .vscode autostart hooks before revoking or rotating credentials. Token revocation can trigger the watcher's handler.
After removal, revoke affected npm and GitHub tokens, rotate other credentials reachable from the host, and audit npm accounts for unexpected releases and GitHub accounts for new repositories or unexpected commits.
A passing provenance attestation did not establish that keyv@6.0.0 was safe: the legitimate release workflow built already-trojanized source.

Indicators of compromise

Type	Indicator	Context
SHA256	`54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668`	Hash of the malicious setup.mjs npm tarball preinstall loader.
SHA256	`9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc`	Hash of the malicious second-stage payload, named Math_Symbol.js in the npm tarball and math_init.js in the repository.
SHA256	`fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb`	Hash of the malicious setup.mjs repository loader used in .claude and .vscode.