On August 4, 2026, a threat actor compromised the source or release credentials for the widely used keyv and cacheable npm packages and published trojanized versions of at least ten packages, beginning with keyv@6.0.0 at 09:35 UTC. Unlike a typical dependency swap, each version carries a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime and executes an obfuscated ~728 KB second stage (Math_Symbol.js). The payload harvests cloud, CI, and registry credentials (AWS instance metadata, Vault, Kubernetes, GitHub Actions, and npm tokens), encrypts them with AES-256-GCM under an operator public key, and delivers them to threat actor GitHub repositories and DNS-resolved destinations. It then self-propagates as a worm, republishing trojanized versions of other packages the stolen npm token can reach and minting fresh sigstore provenance for them. Critically, keyv@6.0.0 shipped with passing npm provenance (a signed SLSA attestation) because the legitimate release workflow built already-trojanized source, so signature verification passed on malware.
AGS-2026-0011
keyv & Cacheable npm Supply Chain Poisoning
Self-check
AgentGuard subscribers receive this advisory automatically and their local guard runs the inspection below.
Inspect paths
~/.nvm/**/node_modules/~/.npm/./node_modules/~/.local/bin/~/.config/gh-token-monitor/~/Library/LaunchAgents/~/.config/systemd/user/.claude/settings.json.vscode/tasks.json
Remediation: block_url— 1.Check & Remove Host-Level Persistence & Dead Man's Switches (CRITICAL: Do NOT revoke credentials before removing host persistence scripts, as doing so may trigger the dead man's switch to execute malicious payloads)
# (1) Check for credential-monitoring dead man's switch scripts and configs
ls -la ~/.local/bin/gh-token-monitor.sh 2>/dev/null && echo "🚨 COMPROMISED: Dead man's switch script detected"
ls -la ~/.config/gh-token-monitor/ 2>/dev/null && echo "🚨 COMPROMISED: Credential monitor config detected"
# (2) Check and unload macOS LaunchAgent persistence
launchctl unload ~/Library/LaunchAgents/com.user.gh-token-monitor.plist 2>/dev/null
rm -f ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
# (3) Check and disable Linux systemd user-level persistence
systemctl --user stop gh-token-monitor.service 2>/dev/null
systemctl --user disable gh-token-monitor.service 2>/dev/null
rm -f ~/.config/systemd/user/gh-token-monitor.service
# (4) Clean up residual files and backdoor configurations
rm -rf ~/.local/bin/gh-token-monitor.sh ~/.config/gh-token-monitor/ /tmp/gh-token-monitor.*
2.Check Dependencies & Workspace Lifecycle Hooks
# Check project lockfiles for compromised package versions
grep -E "(keyv|cacheable|flat-cache|file-entry-cache)" package-lock.json -A1 | grep -E "(6\.0\.0|2\.1\.1|3\.1\.2|2\.5\.1|6\.1\.24|13\.0\.20|2\.2\.1|11\.1\.6|7\.2\.10)"
# Check IDE/AI Agent auto-start backdoor injections in project workspace
grep -rn "setup.mjs\|Math_Symbol.js\|math_init.js" .claude/settings.json .vscode/tasks.json 2>/dev/null
3.Check Malicious File Hashes (SHA-256)
# Verify preinstall loader and second-stage Bun payloads
sha256sum node_modules/keyv/setup.mjs 2>/dev/null
# Malicious SHA-256: 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668
sha256sum node_modules/keyv/Math_Symbol.js 2>/dev/null
# Malicious SHA-256: 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc
4.Credential Revocation & Full Rotation (Execute ONLY after removing host persistence in Step 1)
Immediately revoke and replace all credentials exposed to the environment:
- npm tokens
- GitHub Personal Access Tokens (PAT) & GITHUB_TOKEN
- AWS / GCP / Azure secret keys and credentials
- HashiCorp Vault tokens & Kubernetes Service Account tokens
- CI/CD environment secrets & Organization Secrets
5.Pin or Rollback to Safe Versions
// Example: package.json (Pin to known safe versions prior to 6.0.0 release)
{
"dependencies": {
"keyv": "5.3.3"
}
}
Affected Packages and Versions:
https://socket.dev/supply-chain-attacks/keyv-and-cacheable-compromise