--- title: Keyv and friends compromised in npm supply chain attack description: On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv and eight related npm packages, injecting credential-stealing malware... canonical: https://daily.dev/posts/keyv-and-friends-compromised-in-npm-supply-chain-attack-wpurtvvab twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Keyv and friends compromised in npm supply chain attack | daily.dev og:description: On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv and eight related npm packages, injecting credential-stealing malware... og:url: https://daily.dev/posts/keyv-and-friends-compromised-in-npm-supply-chain-attack-wpurtvvab og:image: https://api.daily.dev/og/posts/WPuRtVVab.png og:image:alt: Keyv and friends compromised in npm supply chain attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Keyv and friends compromised in npm supply chain attack **[Aikido Security](https://daily.dev/sources/aikido-security)** · 3 min read · 3 upvotes · 0 comments ## Summary On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv and eight related npm packages, injecting credential-stealing malware across the entire package family. The attack affected packages with hundreds of millions of monthly downloads, including flat-cache, file-entry-cache, cacheable-request, and others. The attacker pushed malicious files to the main branch and cut new releases, giving the poisoned versions valid npm provenance via GitHub Actions. A preinstall script silently downloaded the Bun runtime and executed a payload (Math_Symbol.js) that harvested npm auth tokens, GitHub CLI tokens, AWS credentials, and HashiCorp Vault tokens, validating them before exfiltration. Developers using any affected version during the window should treat their credentials as compromised and rotate them immediately. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the keyv npm package compromised with malware? Yes, keyv and eight related packages maintained by the same author were compromised on August 4, 2026 after an attacker took over the maintainer's GitHub account. Affected packages include cacheable, cache-manager, cacheable-request, flat-cache, file-entry-cache, and several @cacheable scoped packages, with malicious code pushed directly to main and republished with valid npm provenance. _Track fast-moving supply chain incidents like this one on daily.dev before a compromised dependency lands in your build._ ### What does the Math_Symbol.js malware in the keyv npm supply chain attack actually steal? Math_Symbol.js harvests npm registry auth tokens from .npmrc, GitHub CLI tokens including classic PATs, session tokens, and OIDC tokens, AWS access keys and session tokens from ~/.aws/credentials, and HashiCorp Vault client tokens from the VAULT_TOKEN environment variable. It validates each credential against the live API before exfiltrating it, and it runs via a preinstall script that downloads the Bun runtime to execute the payload. _Developers auditing dependency risk can follow credential-theft campaigns like this on daily.dev as details emerge._ ### How did attackers get malicious code into the keyv npm package if it had valid provenance signatures? They compromised the maintainer's GitHub account directly, pushed the malicious setup.mjs and Math_Symbol.js files straight to the main branch, and then cut a new release immediately. Because the release was built and signed through the normal GitHub Actions pipeline, the poisoned versions carried valid npm provenance despite containing a credential-stealing dropper. _Teams evaluating provenance guarantees for npm packages can track cases like this on daily.dev to spot gaps early._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 46 comments across hackernews (as of 2026-09-14). **TL;DR:** The community is alarmed by the scale of the attack (2B+ monthly installs affected) but quickly pivots to debating systemic fixes — especially whether banning preinstall hooks is a meaningful mitigation or just security theater — with no consensus reached. **Sentiment:** 5% positive · 30% mixed · 65% skeptical **The case for** - Separating CI workflows into unprivileged build/test steps and privileged deploy steps would significantly limit credential exposure in future attacks. - Deno's file-system permission model is cited as a meaningful architectural defense against this class of attack. - A cooling-off period before auto-updating dependencies in CI would give time for alarm bells to sound before compromise. **The pushback** - Preinstall hooks are an obvious attack vector that should be disabled or heavily restricted by default in package managers. - Attackers can trivially move the dropper into index.js and execute at import time, so blocking install hooks alone is insufficient. - Automatically updating dependencies in CI — especially without a review or cooling-off period — dramatically amplifies the blast radius of supply-chain attacks. - GitHub lacks proactive classifiers to detect and lock accounts pushing obviously malicious code before it propagates. - Reporting "2 billion monthly installs" affected is misleading without distinguishing CI installs (which often hold the most privileged secrets) from developer machines. **By community** - hackernews (mixed): Deeply engaged but divided — some push for banning preinstall hooks as a first-aid measure, others argue it's a useless half-measure without broader sandboxing and workflow separation, while a few focus on the scale and immediate remediation steps. **Hottest debate:** Whether disabling preinstall/postinstall hooks is a meaningful security layer or a false sense of security that attackers will trivially bypass by moving malware into regular module code. **Open questions** - Why doesn't npm or GitHub automatically detect and quarantine packages that add new preinstall hooks or download external runtimes at install time? - How should teams structure CI/CD workflows to ensure secrets are never present when untrusted code executes? - What is the actual number of developer/non-CI installs that were exposed, and how many credentials were realistically harvested? **Highlights** > You'll just end up with people running `./configure` scripts or whatever instead. The solution I've currently landed on is: 1. Audit build scripts/ proc macros for rust code (and mark with cargo-vet). 2. Have an isolated workflow for "build/test/push artifact to temporary place" (s3, github artifact, whatever). No API keys in this workflow. 3. Have another workflow that has the API keys to publish that grabs the artifact and then places it into a registry. This creates clear separation of "code runs here" and "environment has privileges". In my own slop-driven programming language I have build scripts declare their capabilities upfront so that you can statically reason about them (same with runtime permissions). > — [insanitybit on hackernews](https://news.ycombinator.com/item?id=49169530) > > almost certainly from running in CI where such secrets don’t exist. CI usually has the most privileged secrets anywhere in a company lol > — [insanitybit on hackernews · 1 comments](https://news.ycombinator.com/item?id=49168961) > You will also not get very far in engineering if you have a production incident, someone proposes a thing that will mitigate it partially but significantly, and you insist that we can't deploy that mitigation because we need to do the multi-year project that will actually fix it instead. Even if we still need that project, we also need that mitigation. Sure, solve the problem of "auditing and trusting codebases". Go for it. Shouldn't take you until, oh, let me be generous and give you until next Monday. No sweat. > — [jerf on hackernews · 1 comments](https://news.ycombinator.com/item?id=49170299) > I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous. Surely Github's software is good enough that an intern can slop the 80/20 together in a day? It would be an actually good use of AI spending. > — [avaer on hackernews · 2 comments](https://news.ycombinator.com/item?id=49168489) > Feel free to turn it off yourself, just don't be surprised when the attackers switch tactics. And don't make life harder for everyone else by pushing it as mandatory. (if you want a better mitigation: don't automatically update dependencies in CI. At a minimum have a cooling-off period that you only bypass on manual review. This is not hard to implement and at least gives some time for alarm bells to be sounded before you're pwned. Probably while doing the updates you can also just do a quick sanity check on the changes, that'll also catch the ones using a blatant install hook) > — [rcxdude on hackernews](https://news.ycombinator.com/item?id=49170697) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49166874) · 102 points · 46 comments ## Similar posts on daily.dev - [Upwind first to report malicious Keyv release that threatened thousands of JavaScript projects](https://daily.dev/posts/upwind-first-to-report-malicious-keyv-release-that-threatened-thousands-of-javascript-projects-aadlzbqz5) · The Next Web · 1 upvotes · 0 comments - [Massive ChainDrop npm supply-chain attack infects hundreds of packages](https://daily.dev/posts/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages-uhzbslfdu) · BleepingComputer · 3 upvotes · 1 comments - [Official SAP npm packages compromised to steal credentials](https://daily.dev/posts/official-sap-npm-packages-compromised-to-steal-credentials-c73lsexvg) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/keyv-and-friends-compromised-in-npm-supply-chain-attack-wpurtvvab) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Keyv and friends compromised in npm supply chain attack","url":"https://daily.dev/posts/keyv-and-friends-compromised-in-npm-supply-chain-attack-wpurtvvab","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/keyv-and-friends-compromised-in-npm-supply-chain-attack-wpurtvvab"},"datePublished":"2026-08-04T10:51:08.530Z","dateModified":"2026-09-14T07:41:00.053Z","description":"On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv and eight related npm packages, injecting credential-stealing malware...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b3cccf2cab6d54a0010be9664dee2cdd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b3cccf2cab6d54a0010be9664dee2cdd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/keyv-and-friends-compromised-in-npm-supply-chain-attack-wpurtvvab","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"Keyv and friends compromised in npm supply chain attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/keyv-and-friends-compromised-in-npm-supply-chain-attack-wpurtvvab#faq","mainEntity":[{"@type":"Question","name":"Is the keyv npm package compromised with malware?","acceptedAnswer":{"@type":"Answer","text":"Yes, keyv and eight related packages maintained by the same author were compromised on August 4, 2026 after an attacker took over the maintainer's GitHub account. Affected packages include cacheable, cache-manager, cacheable-request, flat-cache, file-entry-cache, and several @cacheable scoped packages, with malicious code pushed directly to main and republished with valid npm provenance. Track fast-moving supply chain incidents like this one on daily.dev before a compromised dependency lands in your build."}},{"@type":"Question","name":"What does the Math_Symbol.js malware in the keyv npm supply chain attack actually steal?","acceptedAnswer":{"@type":"Answer","text":"Math_Symbol.js harvests npm registry auth tokens from .npmrc, GitHub CLI tokens including classic PATs, session tokens, and OIDC tokens, AWS access keys and session tokens from ~/.aws/credentials, and HashiCorp Vault client tokens from the VAULT_TOKEN environment variable. It validates each credential against the live API before exfiltrating it, and it runs via a preinstall script that downloads the Bun runtime to execute the payload. Developers auditing dependency risk can follow credential-theft campaigns like this on daily.dev as details emerge."}},{"@type":"Question","name":"How did attackers get malicious code into the keyv npm package if it had valid provenance signatures?","acceptedAnswer":{"@type":"Answer","text":"They compromised the maintainer's GitHub account directly, pushed the malicious setup.mjs and Math_Symbol.js files straight to the main branch, and then cut a new release immediately. Because the release was built and signed through the normal GitHub Actions pipeline, the poisoned versions carried valid npm provenance despite containing a credential-stealing dropper. Teams evaluating provenance guarantees for npm packages can track cases like this on daily.dev to spot gaps early."}}]} ```