Socket's Threat Research Team has identified an active supply chain attack targeting the widely used keyv and cacheable npm package ecosystems. On August 4, 2026, at least ten packages were published with a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime, executes an obfuscated second-stage payload (Math_Symbol.js), harvests cloud and CI credentials (AWS, GCP, Azure, Vault, Kubernetes, GitHub, npm tokens), and self-propagates by republishing trojanized versions of other packages the stolen npm token can reach. The maintainer account (Jaredwray) was compromised, giving the worm access to packages with tens of millions of weekly downloads. The attack is particularly insidious because the published dist code is byte-identical to the clean build — all malicious behavior lives in an added preinstall hook. Provenance attestation passed because the source was already trojanized before the legitimate build pipeline ran. Persistence mechanisms include autostart hooks planted in .claude/settings.json and .vscode/tasks.json, targeting developers and AI coding agents who clone the repository. Affected users should treat any environment that ran install scripts as compromised and rotate all reachable credentials immediately.
