On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv, a key-value storage library with roughly 127 million weekly npm downloads, and used that access to inject credential-stealing malware across the entire package family. The same maintainer owns cacheable (29M downloads/month), flat-cache (565M downloads/month), file-entry-cache (557M downloads/month), and several other widely-used caching utilities, all of which were swept up in the same attack. The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions.
The compromised packages include:
keyv(619M monthly downloads)cacheable(29M/month)cache-manager(16M/month)cacheable-request(133M/month)flat-cache(565M/month)file-entry-cache(557M/month)@cacheable/node-cache(5.9M/month)@cacheable/memory(28M/month)@cacheable/utils(34M/month)ecto(4K/month)
We are also also seeing very active community spread of this supply chain worm to other maintainers and packages, including major organisations:
@deliveroo/reevent1.0.1@or-sdk/invitations1.4.9@picsart/ai-sdk3.32.2@qlik/embed-runtime1.6.4picasso.js2.11.6
Update — August 4, 2026, 13:37 CEST: At least 868 packages (across 1381 versions) have been compromised by the worm, with a combined total of over 2 billion monthly installs at the time of writing.
What happened
Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a "preinstall": "node setup.mjs" entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed.
setup.mjs is a heavily obfuscated dropper. Its only job is to silently download the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ and use it to execute the real payload, Math_Symbol.js:
execFileSync(<bun binary>, ['<script_dir>/Math_Symbol.js'], {
stdio: 'inherit',
cwd: <script_dir>
})What it steals
Math_Symbol.js implements a set of credential extractors, each targeting a different secret store on the victim machine. The payload harvests npm registry auth tokens from .npmrc, GitHub CLI tokens (classic PATs, session tokens, and OIDC tokens) from the GitHub CLI config, AWS access keys and session tokens from ~/.aws/credentials, and HashiCorp Vault client tokens from the VAULT_TOKEN environment variable, with a fallback attempt to retrieve a token via HTTP.
How Aikido detects this
If you are an Aikido user, check your central feed and filter on malware issues. This will surface as a 100/100 critical issue. Aikido rescans nightly, but we recommend triggering a manual rescan now.
If you are not yet an Aikido user, you can create an account and connect your repos. Our malware coverage is included in the free plan, no credit card required.
For broader coverage across your whole team, Aikido's Device Protection gives you visibility and control over the software packages installed on your team's devices. It covers browser extensions, code libraries, IDE plugins, and build dependencies, all in one place. Stop malware before it gets installed.
For future protection, consider Aikido Safe Chain (open source). Safe Chain sits in your existing workflow, intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages against Aikido Intel before install.
