Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack — Threadlinqs Intelligence
As of 2026-08-04, Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-1860 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
Maintainer account jaredwray was compromised to publish malicious versions of keyv (6.0.0) and 10+ packages across the keyv and cacheable ecosystems on August 4, 2026. A malicious preinstall hook
On August 4, 2026, the npm maintainer account 'jaredwray' was compromised and used to publish malicious versions of keyv (6.0.0) and at least ten additional packages across the keyv and cacheable namespaces. These packages are extremely widely used (keyv alone ~154M weekly downloads and 1,700+ dependents) and serve as transitive dependencies of common tooling such as ESLint, meaning most victims never install them directly. The attack is a continuation of the TeamPCP 'Miasma' / 'Mini Shai-Hulud' self-propagating worm campaign first documented in March 2026, which was the first documented supply chain attack to weaponize AI coding agent configuration files as persistence vectors. The malicious keyv@6.0.0 hijacked the legitimate v6.0.0 release that the maintainer had announced for mid-to-late July 2026; the attacker force-pushed to main, deleted and recreated the v6.0.0 tag, and manipulated CI/CD pipelines in real time.
Delivery was carefully crafted: the published library code in dist/ was byte-identical to the last clean release, and all malicious behavior lived in an added preinstall hook in package.json ('preinstall': 'node setup.mjs', with files: [dist, LICENSE, setup.mjs, Math_Symbol.js]). The package behaves normally after install, but the host is already compromised by that point. Stage 1 (setup.mjs) is a lightly obfuscated Node script that detects platform and architecture (including Alpine/musl via ldd --version and /etc/os-release), downloads a standalone Bun 1.3.13 runtime from the official github.com/oven-sh/bun GitHub releases, unzips it (system unzip, or PowerShell Expand-Archive on Windows, or a pure-JS ZIP fallback parser), and executes the second stage under the freshly fetched Bun binary. Running under Bun sidesteps host Node version restrictions and Node-level monitoring.
Stage 2 (Math_Symbol.js, ~728 KB Bun bundle) protects its strings with polymorphic basE91 encoding - one shared numeric opcode table drives dozens of per-scope alphabets decoded lazily, requiring reimplementation of basE91 and brute-forcing each alphabet to recover strings. It targets cloud provider credentials (AWS instance metadata at 169.254.169.254 and 169.254.170.2, credential chains, Secrets Manager across all regions; GCP service account private keys; Azure client secrets), secrets management (HashiCorp Vault tokens from /home/runner/.vault-token and /run/secrets/VAULT_TOKEN), container orchestration (Kubernetes service account tokens from /var/run/secrets/kubernetes.io/serviceaccount/token), CI/CD (GitHub Actions OIDC request tokens, org and repo secrets), and package registry credentials (npm tokens via registry whoami and token endpoints). It also performs a TruffleHog-style regex sweep for keys, bearer tokens, and private key blocks on disk. Internal module log tags include [collector], [dispatcher], [provenance], and [publish].
The payload turns credential theft into a worm by calling registry.npmjs.org/-/whoami to identify the victim, searching the registry for other packages the compromised token can reach, minting publish credentials via the npm OIDC token exchange endpoint (registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/), and for each discovered package downloading the tarball, injecting the same preinstall hook plus payload files, recomputing integrity and shasum, bumping the version, and PUT-ing to the registry. Where npm OIDC trusted publishing is available, republished versions inherit valid provenance - as the blog notes, 'provenance attests build integrity, not source integrity.' The initial keyv@6.0.0 shipped with a passing attestation.
Exfiltration uses no fixed C2 host. Two channels are used: a GitHubSender that creates repositories via POST /user/repos and commits stolen findings using GraphQL's createCommitOnBranch mutation, and a DomainSender that exfiltrates stolen data over DNS. The source repository also plants autostart hooks that activate without npm install: .claude/settings.json (a SessionStar
Weaknesses (CWE)
CWE-494, CWE-506, CWE-912, CWE-829
Target sectors: software-development, technology, cloud-services, financial-services, government administration, health
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1078, T1059, T1204, T1546, T1098, T1027, T1036, T1574, T1528
