Full Report
Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages.
Analysis Summary
# Incident Report: Keyv/Cacheable NPM Supply Chain Attack
## Executive Summary
A software supply chain attack targeted the Keyv/Cacheable ecosystem after a GitHub maintainer account was compromised. Malicious versions of over 40 npm packages were published containing a descendant of the "Shai-Hulud" malware family. The malware is designed to harvest sensitive cloud, developer, and infrastructure credentials, as well as cryptocurrency wallets, utilizing Ethereum RPC infrastructure for command-and-control (C2).
## Incident Details
- **Discovery Date:** August 4, 2026 (Reported)
- **Incident Date:** Circa August 2026
- **Affected Organization:** Multiple (Users of Keyv, Cacheable, and Ornikar packages)
- **Sector:** Software Development / Technology
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 2026
- **Vector:** Credential Compromise
- **Details:** Attackers compromised a GitHub maintainer account with permissions to publish to the Keyv and Cacheable npm ecosystems.
### Lateral Movement
- **Details:** Using the hijacked maintainer access, the attackers published malicious versions of legitimate packages. This allowed the malware to move laterally from the npm registry into the private CI/CD pipelines and developer workstations of organizations downloading these updates.
### Data Exfiltration/Impact
- **Details:** The malware targets cloud credentials (AWS/Azure/GCP), GitHub tokens, SSH keys, Kubernetes configurations, Terraform secrets, and AI-related configuration files. It also targets cryptocurrency wallets for direct financial theft.
### Detection & Response
- **Discovery:** Identified by Wiz Research during an investigation into suspicious npm package updates.
- **Response Actions:** Public disclosure of affected versions, identification of C2 infrastructure, and release of remediation guidance for security teams.
## Attack Methodology
- **Initial Access:** Account Takeover (GitHub maintainer account).
- **Persistence:** Injection of malicious code into widely used library dependencies.
- **Privilege Escalation:** Not applicable for initial access, but the malware attempts to harvest high-privilege cloud and K8s credentials once executed.
- **Defense Evasion:** Use of legitimate npm infrastructure to distribute payloads; use of Ethereum RPC nodes for C2 to blend in with legitimate traffic.
- **Credential Access:** Harvesting of environment variables, config files (Terraform, K8s), and browser-based crypto wallets.
- **Discovery:** Enumeration of CI/CD build runners and cloud environments.
- **Lateral Movement:** Supply chain injection (Provider to Consumer).
- **Collection:** Automated gathering of secrets, tokens, and keys from the local filesystem and environment.
- **Exfiltration:** Data sent to `npm-cache[.]com`.
- **Impact:** Potential full takeover of cloud environments and theft of digital assets.
## Impact Assessment
- **Financial:** Risk of direct theft from cryptocurrency wallets; costs associated with incident response and credential rotation.
- **Data Breach:** Exposure of highly sensitive "keys to the kingdom," including SSH keys, GitHub tokens, and cloud service provider secrets.
- **Operational:** Disruption to development pipelines as teams must pause to purge malicious dependencies and rebuild environments.
- **Reputational:** High impact for the maintainers of the compromised packages and the npm ecosystem.
## Indicators of Compromise
- **Network Indicators:**
- `npm-cache[.]com` (Exfiltration)
- `eth-mainnet.nodereal[.]io` (C2/RPC)
- `go.getblock[.]io` (C2/RPC)
- `eth.llamarpc[.]com` (C2/RPC)
- **File Indicators:**
- `/tmp/bun-dl-*/`
- `node_modules/keyv/Math_Symbol.js`
- **Behavioral Indicators:**
- Deployment of specific string: `IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients`
## Response Actions
- **Containment:** Identify and remove affected versions (e.g., `[email protected]`, `[email protected]`).
- **Eradication:** Treat any system where these versions were installed as compromised. Rotate all secrets, including SSH keys, cloud tokens, and K8s configs.
- **Recovery:** Rebuild CI/CD runners and developer environments from known-good states.
## Lessons Learned
- **MFA is Critical:** The compromise of a single maintainer account can have massive downstream effects; Mandatory MFA for package maintainers is essential.
- **Malware Evolution:** The use of Ethereum RPC for C2 shows attackers are moving toward decentralized infrastructure to avoid traditional domain blacklisting.
- **Dependency Risks:** Popular utility packages (like `keyv`) remain high-value targets due to their deep integration in thousands of applications.
## Recommendations
- **Lock Dependencies:** Use lockfiles (`package-lock.json`) and audit them for unexpected version jumps.
- **Credential Scoping:** Use short-lived, scoped credentials for CI/CD runners rather than long-lived secrets.
- **Integrity Checks:** Implement package integrity verification and provenance controls (e.g., Sigstore/npm provenance).
- **Monitoring:** Monitor for unusual outbound network activity from build servers to unknown RPC endpoints or lookalike domains.