Table of contents

A compromised GitHub maintainer account was used to publish malicious versions of 10 widely-used npm packages in the keyv and cacheable ecosystem, collectively downloaded over 619 million times per month. The attack, attributed to the TeamPCP threat group, deployed a descendant of the “Mini” Shai-Hulud malware family that harvests cloud credentials, GitHub tokens, SSH keys, and CI/CD secrets from developer workstations and build environments. A worm-like self-propagation mechanism has extended the blast radius to over 868 additional packages totaling more than 2 billion monthly installs.

Technical Overview

On August 4, 2026, attackers gained control of the GitHub account behind keyv, one of the most depended-upon packages in the npm ecosystem. The attacker pushed malicious files (setup.mjs and Math_Symbol.js) directly to the main branch and immediately cut new releases. Because the releases were built through the compromised account’s GitHub Actions workflows, the poisoned versions were published to npm with valid provenance signatures, bypassing standard supply chain integrity checks.

The malware operates as a two-stage dropper. A preinstall hook executes setup.mjs, which downloads the Bun JavaScript runtime to run the obfuscated Math_Symbol.js payload (728 KB). Once executed, the payload harvests sensitive credentials and configuration from the host system, including:

  • npm registry authentication tokens from .npmrc
  • GitHub CLI tokens (classic PATs, session tokens, OIDC tokens)
  • AWS access keys and session tokens from ~/.aws/credentials
  • HashiCorp Vault client tokens
  • SSH keys
  • Kubernetes and Terraform configurations
  • AI configuration files (Claude Code, VS Code, Codex)
  • Cryptocurrency wallets
  • Cloud environment metadata and CI/CD secrets

Stolen data is encrypted and exfiltrated to GitHub repositories created under compromised identities.

Affected Systems

The following primary packages are affected: keyv (6.0.0), cacheable, cache-manager (7.2.10), cacheable-request (13.0.20), flat-cache, file-entry-cache, @cacheable/node-cache, @cacheable/memory, @cacheable/utils (2.5.1), and ecto. These packages underpin caching infrastructure across the JavaScript ecosystem and are used by millions of applications, build pipelines, and CI/CD environments worldwide.

The attack includes a worm-like self-propagation mechanism: any maintainer who installed a compromised package had their npm tokens stolen, which the attacker then used to publish poisoned versions of that maintainer’s own packages. This resulted in at least 868 additional packages (1,381 versions) being compromised, including packages from organizations such as Deliveroo, Picsart, Qlik, Ornikar, and HubSync.

Risk Impact

Any developer, build system, or CI/CD runner that installed or updated any of the affected packages after the malicious versions were published on August 4, 2026 should be treated as potentially compromised. Organizations should take the following steps immediately:

  1. Remove affected package versions from all development, build, and CI/CD environments
  2. Treat any system that installed a compromised package as potentially breached and rebuild from a clean state
  3. Rotate all exposed credentials: cloud provider keys (AWS, Azure, GCP), GitHub tokens, SSH keys, Kubernetes configs, Terraform credentials, npm tokens, and Vault tokens
  4. Review cloud and source code environments for unauthorized access
  5. Check for file artifacts indicating compromise: /tmp/bun-dl-*/, node_modules/keyv/Math_Symbol.js
  6. Block IOC domains: npm-cache[.]com, eth-mainnet.nodereal[.]io, go.getblock[.]io, eth.llamarpc[.]com
  7. Enable dependency allowlisting, package integrity verification, and provenance controls

At the time of writing, active exploitation is confirmed and ongoing. The worm propagation mechanism means that the number of compromised packages continues to grow. The severity of this incident and the breadth of credential types harvested make this one of the most impactful npm supply chain attacks to date.

Successful exploitation allows attackers to steal cloud infrastructure credentials, gain unauthorized access to source code repositories, pivot laterally through CI/CD pipelines, and potentially compromise production cloud environments, leading to data exposure, service disruption, or full infrastructure compromise.

How Orca Can Help

Orca enables customers to quickly identify workloads, container images, and CI/CD environments running compromised package versions. Orca’s SCA (Software Composition Analysis) scanning detects the presence of affected packages and highlights them in context, including internet accessibility, runtime reachability, and asset criticality, helping security teams prioritize remediation based on real risk rather than headline severity alone. Orca’s platform surfaces affected assets directly in the alert view, enabling security teams to focus on the most critical remediation paths first.

Table of contents