Full Report
A credential-stealing npm worm that first appeared in [email protected] spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026. SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages
Analysis Summary
# Incident Report: Keyv-Linked npm Supply Chain Compromise
## Executive Summary
On August 4, 2026, a credential-stealing worm was discovered in the popular `keyv` npm package, starting with version 6.0.0. The malware utilized a `preinstall` script to harvest credentials (cloud, GitHub, and private keys) and automatically propagated by poisoning hundreds of other packages using stolen developer identities. The incident highlighted significant risks in automated dependency lifecycle scripts and workspace trust models in modern IDEs.
## Incident Details
- **Discovery Date:** August 4, 2026
- **Incident Date:** August 4, 2026
- **Affected Organization:** Multiple (Impacted the `keyv` and `cacheable` namespaces specifically)
- **Sector:** Software Development / Technology
- **Geography:** Global (npm registry)
## Timeline of Events
### Initial Access
- **Date/Time:** August 4, 2026
- **Vector:** Malicious package update (Supply Chain Attack)
- **Details:** The attacker gained publishing access to the `keyv` package and released version 6.0.0, which included a malicious `preinstall` script.
### Lateral Movement
- **Mechanism:** Automated Propagation. The malware harvested npm publishing tokens from infected developer machines and CI/CD environments, using them to version and republish other packages controlled by those identities, creating a "worm" effect across the registry.
### Data Exfiltration/Impact
- **Assets Targeted:** GitHub tokens, npm registry tokens, cloud provider credentials (AWS/GCP/Azure), HashiCorp Vault secrets, Kubernetes configurations, and SSH private keys.
- **Specific Hook:** The malware also integrated hooks for Claude Code and VS Code to execute payloads when a developer opened a compromised repository.
### Detection & Response
- **Discovery:** Identified by security firms SafeDep, Socket, and Aikido.
- **Response:** The npm registry team began reverting malicious versions to previous "known good" states (e.g., reverting `keyv` to 5.6.0). Security researchers published analysis on the malware's credential-revocation watcher.
## Attack Methodology
- **Initial Access:** Compromise of legitimate npm maintainer accounts.
- **Persistence:** Implementation of VS Code `tasks.json` (`runOn: folderOpen`) and Claude Code `SessionStart` hooks.
- **Defense Evasion:** Use of a multi-stage execution (stage one checks for Bun runtime; stage two executes a compiled 700KB+ binary bundle).
- **Credential Access:** Harvesting secrets from environment variables, local configuration files, and memory (GitHub Actions runners).
- **Lateral Movement:** Automated republishing of downstream packages using stolen npm credentials.
- **Impact:** Wide-scale poisoning of the npm ecosystem; potential for long-term access via stolen private keys.
## Impact Assessment
- **Financial:** Undisclosed, but significant cost associated with rotation of global secrets and audit time.
- **Data Breach:** High volume of developer and infrastructure secrets exfiltrated.
- **Operational:** Disruption to CI/CD pipelines and developer workflows as packages were pulled or reverted.
- **Reputational:** Damage to trust in the `keyv` ecosystem and general npm dependency security.
## Indicators of Compromise
- **File Indicators:**
- `setup.mjs`
- `Math_Symbol.js`
- `.claude/setup.mjs`
- `.vscode/setup.mjs`
- **Behavioral Indicators:**
- Unexpected `preinstall` execution of `node setup.mjs`.
- Downloads of the Bun runtime (version 1.3.13) from GitHub during npm installs.
- Unexpected package version increments (e.g., jumping to version 6.x.x suddenly).
## Response Actions
- **Containment:** npm registry reverted many "latest" tags to non-malicious versions.
- **Eradication:** Identification of at least 868 poisoned packages for removal.
- **Recovery:** Developers advised to treat all environments that ran the poisoned code as fully compromised.
## Lessons Learned
- **Lifecycle Risks:** The danger of `preinstall` and other lifecycle scripts remains a primary vector for npm malware.
- **Workspace Trust:** IDE features that run code automatically on folder-open (like VS Code tasks) can be weaponized in supply chain attacks.
- **Token Management:** The speed at which the worm spread demonstrates the danger of long-lived, high-privilege CI/CD and npm tokens.
## Recommendations
- **Upgrade npm:** Use npm 12+ which disables dependency lifecycle scripts by default (`--ignore-scripts`).
- **Secret Management:** Implement short-lived, environment-specific tokens and OIDC for CI/CD runners where possible.
- **Verification:** Always use lockfiles (`package-lock.json`) and consider using tools that audit dependencies for behavioral changes rather than just known CVEs.
- **Caution:** If compromised, **remove the malware's revocation watcher** before rotating keys to prevent the malware from reacting to the rotation attempt.