Keyv and Cacheable npm Supply Chain Compromise

An active supply chain compromise has impacted key packages within the keyv and cacheable ecosystems on npm, with at least ten packages manifesting malicious preinstall hooks. These hooks download standalone Bun runtimes, execute obfuscated second-stage payloads, extract cloud and CI credentials, and possess the ability to publish compromised versions of additional npm packages. The total weekly downloads for these affected packages amount to tens of millions, and further malicious packages may emerge.

Security researchers suspect the Jaredwray maintainer account was breached, initially revealing compromised activity within the keyv and cacheable packages. The malware can amass credentials from various sources, including cloud, CI, GitHub, npm, Vault, and Kubernetes. It can also repackage and republish npm packages with the same malicious preinstall hook.

The compromised repositories have reportedly sent encrypted stolen data to GitHub repositories and DNS-resolved destinations, added autostart files to cloned repositories, and installed a host-level credential-monitoring persistence mechanism.

The malicious packages manifest through the npm lifecycle process, not by altering the library's distributed code. The compromised package's dist/ output is SHA-256 identical to the clean 6.0.0-rc.1 build, making it difficult to differentiate from legitimate installations. The malicious changes encompass the addition of setup.mjs and Math_Symbol.js, which initiate a loader process.

This loader detects the operating system, system architecture, and Alpine and musl environments, potentially avoiding controls focused solely on Node activity.

The loader can extract the downloaded runtime using various systems, such as the system unzip utility, Windows PowerShell Expand-Archive, or a built-in JavaScript ZIP parser. After execution, it removes its temporary directory, reducing the number of disk artifacts. The malicious payload is then implemented through a Bun bundle called Math_Symbol.js, which protects strings using polymorphic basE91 encoding and retrieves AWS instance metadata endpoints, reads AWS credential chains, and gathers GCP service account private keys and Azure client secrets.