The popular Keyv npm package, known for its significant role in key-value storage, has become the latest victim in a large-scale cybersecurity breach. The incident involves attackers gaining unauthorized access to the GitHub account of the package’s maintainer, thereby deploying malware designed to steal credentials across multiple software packages. Keyv, with an impressive 127 million weekly downloads, is at the center of a significant supply chain threat.
Details of the Breach and Its Impact
On August 4, 2026, one of the most extensive npm supply chain breaches occurred when malicious code spread across numerous packages within hours. This incident was detailed in an exclusive report to Cybersecuritynews by Aikido. The breach affected not only Keyv but also other popular caching utilities managed by the same maintainer, such as cacheable, flat-cache, and file-entry-cache.
The attackers exploited the legitimate appearance of these packages by integrating malicious files directly into the main branch. Valid provenance signatures generated by GitHub Actions further concealed the compromised versions, thereby misleading audits on supply chain integrity.
Mechanism and Reach of the Malware
The malicious activity involved two files, setup.mjs and Math_Symbol.js, which were added to each affected package. A preinstall hook was silently embedded within the package.json file, which executed setup.mjs during installation. This file functioned as an obfuscated dropper, downloading the Bun JavaScript runtime and launching Math_Symbol.js without alerting developers.
Dubbed part of the Shai-Hulud campaign, this malware rapidly spread beyond the initial packages, affecting major organizations like Deliveroo and Picsart. Aikido confirmed that by the afternoon of August 4, at least 868 packages across 1,381 versions had been compromised, with numbers continuing to rise.
Protective Measures and Future Outlook
Math_Symbol.js is engineered to extract credentials from various secret stores on developer machines, targeting npm, GitHub, and AWS tokens. Successful credential thefts could lead to further account breaches and malicious package releases, intensifying the threat across the npm ecosystem.
Organizations dependent on affected packages like Keyv and its related utilities should urgently review and update their lockfiles, rotate security tokens, and avoid new installations involving compromised dependencies. Given the rapid spread, security teams are advised to scrutinize recent CI pipeline activities for potential exposure.
The scope and speed of this breach underscore the need for enhanced vigilance and immediate action in securing software supply chains. As the situation evolves, maintaining robust security protocols remains crucial in mitigating further risks.
