Keyv, cacheable npm supply chain attack hits 400-plus packages

An npm supply chain attack initially affecting the popular keyv and cacheable namespaces spread to more than 400 unique packages since Tuesday morning, according to Socket and Wiz researchers.

The attack began with the apparent compromise of the maintainer account “Jaredwray,” which had access to both the keyv and cacheable npm namespaces. The affected packages have a combined weekly download count in the tens of millions, according to Socket.

Keyv is a key-value storage library with support for backend adapters, including Redis, SQLite, Postgres and MongoDB adapters. Cacheable and related packages including cacheable-request, flat-cache and file-entry-cache are popular caching libraries.

“These are foundational packages that sit deep in dependency trees, so their reach is largely indirect. A common chain is eslint to file-entry-cache to flat-cache to keyv, which means most affected users never install any of them directly,” Socket researchers noted.

On Tuesday morning, [email protected] was published with a malicious preinstall hook, followed by several malicious package versions under the cacheable namespace containing the same malicious hook.  This hook installs a loader, setup.mjs, which is a Node script that downloads a standalone Bun runtime and uses it to execute a second-stage payload, Math_Symbol.js.

Math_Symbol.js is a Bun bundle with strings encoded using a polymorphic basE91 encoding technique. This payload targets a range of secrets for exfiltration including cloud keys (AWS, GCP and Azure), HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC tokens and npm tokens. It also performs a “TruffleHog style” sweep for other keys and tokens on the disk, according to Socket.

The malware spreads itself using stolen npm tokens, identifying the packages it can access, adding the malicious preinstall hook and publishing malicious versions via npm OIDC trusted publishing. More than 400 unique packages have been affected so far, with both Socket and Wiz tracking affected packages during the ongoing attack.

Stolen data is encrypted using AES-256-GCM and exfiltrated to GitHub repositories before being sent to external destinations, according to Socket. Wiz reported that the malware retrieves its exfiltration domains from an Ethereum smart contract.

The GitHub repositories receiving the stolen data were noted by Socket to include .claude and .vscode files containing autostart hooks that launch the malicious loader when a developer or AI agent clones and opens the repository.

The credential harvesting pattern, self-propagation technique and exfiltration of stolen data to GitHub are consistent with past Mini Shai-Hulud attacks, Socket noted. Wiz also reported that GitHub repositories containing the stolen data bear the description “Shai-Hulud: Here We Go Again.”

The original Mini Shai-Hulud attack against TanStack in May was conducted by the threat actor TeamPCP, but the release of the Mini Shai-Hulud source code later that month means separate threat actor may be behind the latest attacks.

The installation of a standalone Bun runtime, the use of a modular dispatcher with separate GitHub and domain-based exfiltration channels, and the inclusion of autostart hooks in .claude and .vscode files are tactics that have not been seen in earlier Mini Shai-Hulud attacks, Socket noted.

Developers are advised to pin affected packages to a confirmed clean version, rebuild lockfiles and prevent the installation of new releases while the attack is ongoing. Socket noted that a “dead-man’s switch” in the malware polls the GitHub API every 60 seconds and causes the payload to evaluate a remote-supplied handler string, delete its state and exit when it loses access to stolen GitHub tokens, meaning security teams are advised to remove this switch and all malicious loaders and implants prior to rotating all potentially compromised credentials.

Developers should audit their npm and GitHub accounts for unexpected package versions, repositories and commits, and review their cloud and source code environments for unauthorized access. Wiz also recommended increasing resilience against supply chain attacks by using dependency allowlisting, package integrity verification and provenance controls.