Worm-like npm Attack Punishes Token Revocation
A sophisticated supply-chain attack on the keyv and cacheable npm packages uses a worm-like mechanism and a novel dead-man's switch that punishes token revocation.
A novel supply-chain attack targeting the widely used keyv and cacheable npm packages has emerged, employing a unique worm-like propagation method and a dangerous dead-man's switch that actively punishes remediation efforts. The attack, which began on August 4, 2026, saw an attacker compromise maintainer accounts for these critical caching libraries, publishing trojanized releases that inject malicious code into the software supply chain.
The malicious payload is delivered via a preinstall hook in the compromised packages, which downloads and executes a standalone Bun runtime. This runtime then obfuscates and runs a second-stage script responsible for harvesting sensitive credentials. The stolen information includes npm tokens, cloud keys (AWS, Vault, Kubernetes), GitHub Actions secrets, and a broad sweep for private keys and bearer tokens on disk. This credential theft is the first phase of the attack.
What elevates this incident beyond typical supply-chain compromises is its worm-like propagation. Using the stolen npm tokens, the attacker injects the same malicious hook into other packages accessible by the compromised identity. The attacker then recomputes integrity hashes and republishes these packages, rapidly expanding the attack's reach. Initial analysis indicates over 440 packages across more than two thousand versions have been affected, with the campaign still actively spreading.
Compounding the threat, the attack vector is not limited to npm install. The malicious code also includes hooks for IDEs and agent autostart, such as entries in .claude/settings.json and .vscode/tasks.json. This means simply opening a cloned repository in an IDE or by an AI agent can trigger the payload, broadening the attack surface to include security engineers investigating the incident and automated coding tools.
The most alarming aspect is the payload's dead-man's switch. Alongside credential theft, the malware installs a system-level monitor that polls the GitHub API using a stolen token. If the token is revoked (a standard incident response action), the monitor triggers an attacker-controlled handler and then self-destructs. This mechanism turns a crucial security step into an attack trigger, creating a high-risk scenario where defenders might inadvertently activate destructive code.
This attack also bypasses several common security checks. The compromised [email protected] package shipped with a valid SLSA attestation, demonstrating that provenance attests to build integrity, not source integrity. Furthermore, the core library code remained unchanged, with malice hidden in package.json and new files, making diff-based analysis insufficient. Many victims are affected transitively, as keyv is a dependency of other popular packages like eslint and file-entry-cache.
Incident response requires a counterintuitive approach. The recommended steps prioritize isolating affected hosts from the network immediately, as this prevents the dead-man's switch from firing due to lack of network connectivity. Evidence preservation is critical, as the watcher self-clears within approximately 24 hours. Only after isolating and preserving evidence should teams proceed with eradicating the malware, unloading persistent agents, and finally rotating credentials, starting with npm tokens to halt further propagation.