--- title: Popular npm Packages in the keyv and Cacheable... description: Socket's Threat Research Team has identified an active supply chain attack targeting the widely used keyv and cacheable npm package ecosystems. On August 4,... canonical: https://daily.dev/posts/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-co--yh1jxy7bk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Popular npm Packages in the keyv and Cacheable Namespaces Co... | daily.dev og:description: Socket's Threat Research Team has identified an active supply chain attack targeting the widely used keyv and cacheable npm package ecosystems. On August 4,... og:url: https://daily.dev/posts/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-co--yh1jxy7bk og:image: https://api.daily.dev/og/posts/yH1JXY7bk.png og:image:alt: Popular npm Packages in the keyv and Cacheable Namespaces Co... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Popular npm Packages in the keyv and Cacheable Namespaces Co... **[Socket](https://daily.dev/sources/socketdev)** · 9 min read · 0 upvotes · 0 comments ## Summary Socket's Threat Research Team has identified an active supply chain attack targeting the widely used keyv and cacheable npm package ecosystems. On August 4, 2026, at least ten packages were published with a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime, executes an obfuscated second-stage payload (Math_Symbol.js), harvests cloud and CI credentials (AWS, GCP, Azure, Vault, Kubernetes, GitHub, npm tokens), and self-propagates by republishing trojanized versions of other packages the stolen npm token can reach. The maintainer account (Jaredwray) was compromised, giving the worm access to packages with tens of millions of weekly downloads. The attack is particularly insidious because the published dist code is byte-identical to the clean build — all malicious behavior lives in an added preinstall hook. Provenance attestation passed because the source was already trojanized before the legitimate build pipeline ran. Persistence mechanisms include autostart hooks planted in .claude/settings.json and .vscode/tasks.json, targeting developers and AI coding agents who clone the repository. Affected users should treat any environment that ran install scripts as compromised and rotate all reachable credentials immediately. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Massive ChainDrop npm supply-chain attack infects hundreds of packages](https://daily.dev/posts/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages-uhzbslfdu) · BleepingComputer · 3 upvotes · 1 comments - [Upwind first to report malicious Keyv release that threatened thousands of JavaScript projects](https://daily.dev/posts/upwind-first-to-report-malicious-keyv-release-that-threatened-thousands-of-javascript-projects-aadlzbqz5) · The Next Web · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-co--yh1jxy7bk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Popular npm Packages in the keyv and Cacheable Namespaces Co...","url":"https://daily.dev/posts/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-co--yh1jxy7bk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-co--yh1jxy7bk"},"datePublished":"2026-08-04T11:58:27.283Z","dateModified":"2026-08-05T02:09:06.407Z","description":"Socket's Threat Research Team has identified an active supply chain attack targeting the widely used keyv and cacheable npm package ecosystems. On August 4,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/65540b258de84fef4c00b6fefe12602e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/65540b258de84fef4c00b6fefe12602e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-co--yh1jxy7bk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,npm","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Popular npm Packages in the keyv and Cacheable Namespaces Co..."}]} ```