Threat Summary
A sophisticated supply chain attack has actively compromised multiple npm packages, including keyv, cacheable, cacheable-request, flat-cache, file-entry-cache, and possible related adapters. Attackers took control of a popular maintainer’s npm account on or before August 4, 2026, and began publishing trojanized package versions containing a preinstall hook (setup.mjs) as a loader. The loader downloads the Bun runtime, executes a heavily obfuscated second-stage payload (Math_Symbol.js), and sweeps the system for sensitive credentials.
The malware exfiltrates stolen secrets and commits to attacker-controlled GitHub repositories, establishing persistence with hooks in IDE config files. Using any affected package as a direct or transitive dependency will trigger the attack when npm install runs, severely impacting CI/CD, developer, and build environments globally. The worm uses stolen credentials to propagate by publishing malicious package versions through hijacked npm and CI tokens.
The attack affects the global JavaScript and Node.js ecosystem. Typical SBOM/provenance or signature enforcement did not prevent exploitation, as the malicious artifacts inherited trusted maintainers’ keys. Existing industry advisories indicate that the risk is severe and ongoing for all organizations in the JavaScript supply chain.
Recommendations
Audit Dependencies
- Check package-lock.json, lock, and direct dependencies for keyv, cacheable, cacheable-request, flat-cache, file-entry-cache, cache-manager@7.2.10, @cacheable/utils@2.5.1, three additional @cacheable/* packages, and all @keyv/* scoped packages.
- Versions listed as compromised: keyv@6.0.0, cacheable@2.5.1, cacheable-request@13.0.20, flat-cache@6.1.24, file-entry-cache@11.1.7, cache-manager@7.2.10, @cacheable/utils@2.5.1, and related @cacheable/* and @keyv/* packages.
- More than 400 packages may be impacted via propagation, and should be removed or replaced immediately.
Pin and Downgrade
- Pin all affected packages to known safe versions published before August 2026 (e.g., keyv@5.6.0 or earlier; cacheable@2.5.0 or earlier in the 2.x line).
- Avoid semver wildcards (^, ~) that may resolve to tainted versions.
Credential Rotation
- Rotate all potentially exposed credentials, including: npm tokens, CI/CD secrets, environment variables, cloud provider (AWS/GCP/Azure) keys, GitHub PATs, Vault tokens, SSH keys.
- Assume any credential present on a build or dev machine using these packages is compromised.
Upgrade npm
- Use npm v12+ if possible; it disables install-time scripts (preinstall/postinstall) by default, reducing future risk. For older npm, set config set ignore-scripts true globally and in CI.
Enforce Least Privilege in CI/CD
- Separate dependency install steps (npm ci –ignore-scripts) from privileged or secret-bearing build jobs. Limit environment variable and credential exposure during installs.
Multi-Factor Authentication (MFA) and Token Hygiene
- Enforce strong, phishing-resistant MFA for all developer, npm, and source code hosting accounts. Audit all tokens for overbroad scopes and eliminate unused/legacy tokens.
Prepare for Ecosystem Updates
- Monitor npm, GitHub, CISA, and package maintainer channels for emergent official advisories or patches. Update immediately when issued.
Long-Term Measures
- Integrate lockfile linting and deterministic install workflows (npm ci, yarn install –immutable) to harden builds against dependency drift or tampering.
- Institute allowlisting/quarantine policies to block installs of newly published package versions or installs from untrusted sources.
- Maintain rapid credential rotation processes and backup/rollback dependencies for critical services.
Temporary Workarounds
Ignore Scripts Temporarily
- Set npm config set ignore-scripts true in global and CI environments to block preinstall/postinstall hooks. (Note: This may break legitimate packages relying on lifecycle scripts.)
Pin to Safe Versions
- Manually pin affected packages to last known safe versions prior to August 2026, and consider using shrinkwrap or lockfile overrides to prevent updates.
Isolate Build Steps
- Run dependency installs (npm ci –ignore-scripts) in a separate, sandboxed stage with no access to secrets, then execute privileged steps in a clean environment.
Dependency Pruning
- Remove unused dependencies or minimize reliance on deep dependency chains, especially those with recent publish activity from single maintainers.
IDE Hardening
- Scan IDE config folders (.vscode, .claude) for added tasks or hooks and sanitize if found.
Limitations: These workarounds reduce risk but do not remove tainted packages already installed or eliminate persistence artefacts. Upstream fixes/advisories, when available, must be applied promptly.
References:
- https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain?utm_medium=feed
- https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/?utm_source=openai
- https://research.splunk.com/stories/npm_supply_chain_compromise/?utm_source=openai
- https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
- https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
