Threats Tagged 'package repository'

A supply chain attack has compromised the keyv and cacheable npm packages by injecting malicious preinstall hooks into at least ten packages. The attack started with the compromise of a maintainer account, enabling the threat actor to distribute malware that harvests cloud and CI credentials from multiple platforms. The malware self-propagates by repackaging other npm packages with the malicious code and republishing them using stolen tokens. Stolen credentials are exfiltrated to attacker-controlled GitHub repositories, and persistence mechanisms are established in developer directories. This campaign affects tens of millions of weekly downloads and targets developer environments and cloud infrastructure credentials.