Socket
@SocketSecurity
·
8h
🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading.
Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all packages/versions.
https://x.com/SocketSecurity/status/2084643761900970391
Active supply chain attack on npm: keyv and cacheable are compromised right now, and the payload is a worm.
The maintainer account behind both package families was compromised. On August 4, ten packages were republished with a malicious preinstall hook that steals your credentials, then uses those credentials to publish itself into more packages. Malicious versions are live on npm as I write this.
These are foundational packages. keyv, cacheable, flat-cache, and file-entry-cache sit deep in dependency trees as transitive deps of common tooling like ESLint. Tens of millions of weekly downloads. Most affected users never installed them directly.
What the payload does:
• preinstall hook (setup.mjs) downloads a standalone Bun runtime and runs the second stage under it, sidestepping the host Node version and any Node-level monitoring
• Harvests cloud and CI credentials: AWS/GCP/Azure keys, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC, and npm tokens
• Repackages other npm packages with the same hook and republishes them through npm OIDC trusted publishing. This is what makes it a worm.
• Exfiltrates over DNS and by committing stolen secrets to attacker-created GitHub repos
• Plants autostart hooks in .claude and .vscode that execute when a developer or an AI coding agent opens the cloned repo. No npm install required.
The detail worth sitting with: keyv@6.0.0 shipped with a passing npm provenance attestation. The build pipeline faithfully attested a source that was already trojanized. Signature verification alone did not stop this.
Socket’s AI scanner flagged the malicious setup.mjs hook. If you install anything in the keyv,
@keyv
, or cacheable scopes:
• Pin to the last known-clean version and rebuild lockfiles by integrity hash. No caret or tilde ranges, no npm update.
• Better: block the entire keyv,
@keyv
, and cacheable scope at your registry proxy until the account is confirmed clean.
• Rotate and revoke every credential reachable from any host that ran install scripts. npm and GitHub tokens should be revoked, not just rotated.
Developing story. Socket is updating the affected-package list as new versions appear.
Full research report with IoCs: https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain
If you are dealing with this right now and want help, email sales@socket.dev and we will spin up emergency white-glove assistance.
https://x.com/feross/status/2084648858605465801
Some AI's require npm as a dependency.
Waiting for this thing to compromise AI…
Mastra AI (and related AI tooling) packages on npm were compromised in multiple supply-chain attacks in 2026, most notably a North Korean-linked campaign against the @mastra
scope.
techtimes.com
Mastra AI Framework Compromise (June 2026)Attackers (attributed by Microsoft with high confidence to North Korea’s Sapphire Sleet / BlueNoroff) compromised a dormant contributor account with lingering publish rights to the @mastra npm organization.
In an ~88-minute window on June 17, 2026, they republished 144 packages in the Mastra AI framework (used for building AI agents, workflows, and RAG pipelines).
The packages themselves were not altered in source; a phantom/malicious dependency (easy-day-js, a typosquat of the legitimate dayjs library) was injected. Due to SemVer caret ranges (^), fresh npm installs automatically pulled the malicious version.
The payload harvested LLM API keys (OpenAI, Anthropic, Google), cloud credentials (AWS/Azure/GCP), CI/CD secrets, GitHub tokens, SSH keys, browser data, and crypto wallets.
techtimes.com
Security researchers (including StepSecurity) advised treating any environment that installed @mastra packages during the window as compromised.Broader Pattern: AI Tools + Compromised npmSeveral other 2025–2026 incidents specifically involved or targeted AI coding agents and frameworks:Nx packages (August 2025): Malicious versions weaponized locally installed AI CLIs (Claude Code, Gemini CLI, Amazon Q) by invoking them with dangerous flags to scan for secrets and write inventories of sensitive files.
theregister.com
Miasma / Shai-Hulud variants (May–June 2026): Self-propagating worms compromised packages (including AI-related ones such as @vapi-ai/server-sdk and ai-sdk-ollama). They targeted AI tool configs (.claude/, Cursor rules, Gemini CLI, VS Code tasks), stole AI credentials/MCP server settings, and planted persistence so opening a project in those tools re-triggered the malware.
snyk.io
ChainDrop / ongoing Shai-Hulud descendant (August 4, 2026): A fast-spreading worm started with the popular keyv package family and rapidly infected hundreds of packages (reports of 400–1,280+ packages / 2B+ monthly downloads). It specifically hunts AI-tool credentials (Claude Code, Cursor, Codex, OpenAI, Gemini) and plants persistence hooks in those tools. Some affected packages include AI-related ones (e.g., under Picsart AI SDK scopes).
devops.com
Other related issues include “slopsquatting” (attackers registering package names that AI coding agents hallucinate) and malware that tricks AI agents into installing malicious packages or proxies LLM traffic.Practical AdviceIf you use (or used) Mastra AI, any of the high-download packages in the ChainDrop wave, or AI coding assistants that auto-install npm dependencies, audit recent installs, rotate all credentials (especially LLM API keys, cloud tokens, and npm/GitHub tokens), and check for unexpected files in AI tool config directories.
Prefer pinned versions, enable npm provenance checks where available, use tools that scan for malicious lifecycle scripts/binding.gyp abuse, and treat AI-assisted dependency installation as higher risk.
These incidents highlight how npm’s design (lifecycle scripts, auto-upgrades via SemVer, and long-lived tokens) combined with the rapid adoption of AI coding agents creates a high-value target for credential theft and persistence.