On August 4, 2026, a supply chain compromise affected the keyv and cacheable npm packages by injecting malicious preinstall hooks into at least ten packages. The attacker gained access by compromising the maintainer account 'Jaredwray', allowing the insertion of obfuscated payloads that download a Bun runtime. The malware harvests credentials from AWS, GCP, Azure, HashiCorp Vault, Kubernetes, GitHub Actions, and npm tokens. It propagates by repackaging other npm packages with the malicious hook and republishing them using stolen npm tokens. Exfiltrated credentials are sent to threat actor-controlled GitHub repositories, and persistence is maintained in developer directories. This attack represents a self-propagating supply chain compromise targeting cloud and CI/CD credentials across multiple platforms.

The attack compromises developer environments by stealing cloud and continuous integration credentials, potentially allowing unauthorized access to cloud resources and CI/CD pipelines. The self-propagating nature of the malware increases the risk of widespread infection across npm packages. Credential theft from multiple cloud providers and developer tools can lead to further compromise of infrastructure and sensitive data. Persistence mechanisms in developer directories may enable long-term unauthorized access and lateral movement within affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or guidance are published, developers should audit their npm dependencies for malicious preinstall hooks, revoke and rotate any potentially compromised credentials and tokens, and monitor for suspicious activity related to npm package publishing and cloud credential usage. Avoid using affected packages until a verified clean version is available. Follow updates from npm and package maintainers regarding remediation steps.