keyv and cacheable npm Package Hijacked in Supply Chain Attack

Wiz

PricingGet a demo

Get a demo

Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple npm packages in the `Keyv`/`Cacheable` ecosystem. This blog presents our initial findings based on the analysis completed so far. As our investigation continues, we will update this post with additional technical details, indicators of compromise, attribution insights, and any newly identified affected packages or infrastructure.

What happened?

Multiple npm packages in the `keyv`/`cacheable` ecosystem were compromised following the compromise of a GitHub maintainer account, resulting in the publication of malicious package versions. All versions shared a consistent payload. Starting at 9:00 UTC, the attacker first used a compromised identity to introduce IDE persistence payloads to the `keyv` repository, and then shortly after published a new version of `keyv` containing their payload.

Wiz analysis indicates the payload is a descendant of the "Mini" Shai-Hulud malware family, sharing similarities with the TeamPCP and antv supply chain campaigns.

The malware targets a broad range of sensitive data, including cloud credentials, infrastructure secrets, developer credentials, AI-related configuration files, and cryptocurrency wallets. It also attempts to harvest secrets from CI/CD environments, identify build runners, and enumerate cloud environments to facilitate credential theft and further compromise.

Data is exfiltrated via GitHub repositories created under compromised identities, using the description `Shai-Hulud: Here We Go Again`, matching the Shai-Hulud code that was previously open-sourced. A new intimidation string is used in the initial commits, `IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients`.

What steps should security teams take?

1. Identify and remove the affected package versions from development, build, and CI/CD environments. 2. Treat affected systems as potentially compromised and rebuild them if the malicious packages were installed. 3. Rotate exposed credentials, including cloud credentials, GitHub tokens, SSH keys, Kubernetes configurations, Terraform credentials, and other developer secrets. 4. Review cloud and source code environments for unauthorized access or suspicious activity following package installation. 5. Monitor for the published IOCs, including the identified domains, file artifacts, and other indicators associated with the campaign. 6. Strengthen software supply chain defenses by enabling dependency allowlisting, package integrity verification, and provenance controls where available.

Affected Packages

Track the full list of impacted packages over on our GitHub.

| Package | Malicious Version | | ----------------------------------------- | ----------------- | | @cacheable/utils | 2.5.1 | | @hubsync/web-sdk-react | 6.3.7 | | @nebula.js/nucleus | 0.5.1 | | @ornikar/babel-preset-base | 6.0.3 | | @ornikar/babel-preset-kitt-universal | 8.0.3 | | @ornikar/babel-preset-react | 6.1.4 | | @ornikar/browserslist-config | 8.0.3 | | @ornikar/commitlint-config | 8.3.2 | | @ornikar/eslint-config-babel | 24.0.1 | | @ornikar/eslint-config-react | 24.0.1 | | @ornikar/eslint-config-typescript | 24.0.1 | | @ornikar/eslint-config-typescript-react | 24.0.1 | | @ornikar/eslint-plugin-neverthrow | 1.3.1 | | @ornikar/eslint-plugin-ornikar | 24.0.1 | | @ornikar/graphql-config | 1.1.1 | | @ornikar/intl-config | 10.0.2 | | @ornikar/kitt2 | 1.0.1 | | @ornikar/monorepo-config | 14.3.2 | | @ornikar/postcss-config | 9.1.2 | | @ornikar/prettier-config | 9.0.3 | | @ornikar/prismic-components | 0.0.2 | | @ornikar/react-modern-calendar-datepicker | 3.2.1 | | @ornikar/react-native-svg-transformer | 1.0.6 | | @ornikar/renovate-config | 9.0.2 | | @ornikar/repo-config-react | 13.0.8 | | @ornikar/repo-config-react-legacy-css | 15.1.2 | | @ornikar/rollup-plugin-postcss | 2.0.5 | | @ornikar/stylelint-config | 14.0.3 | | @ornikar/typed-css-modules-loader | 0.8.2 | | @qlik/embed-react | 2.5.3 | | @qlik/embed-runtime | 1.6.4 | | @qlik/embed-web-components | 1.7.3 | | @qlik/runtime-module-loader | 1.5.1 | | @thiennq/docs-viewer | 1.6.2 | | babel-plugin-linaria-css-to-undefined | 0.3.1 | | cache-manager | 7.2.10 | | cacheable-request | 13.0.20 | | http-metrics-middleware | 2.2.2 | | keyv | 6.0.0 | | picasso-plugin-hammer | 2.11.6 | | picasso-plugin-q | 2.11.6 | | pob-test-package-in-monorepo | 5.2.1 |

Indicators of Compromise (IOCs)

Domains

• `npm-cache[.]com` \- Exfil domain (104.21.35\[.\]216, Cloudflare)
• `eth-mainnet.nodereal[.]io` \- ETH RPC (35.175.164\[.\]77, Amazon)
• `go.getblock[.]io` \- ETH RPC (185.44.207.215)
• `eth.llamarpc[.]com` \- ETH RPC (172.67.167.200, Cloudflare)

File Artifacts

`/tmp/bun-dl-/`

• `node_modules/keyv/Math_Symbol.js`

| File | Hash | | ---------------------- | ---------------------------------------- | | Math\_Symbol.js | 35a672cf34b996b91f3e1c28cbf3a05a37e036e4 | | math\_init.js | 35a672cf34b996b91f3e1c28cbf3a05a37e036e4 | | setup.mjs (in .claude) | 686aa40d0fc22c8d569494543a0f891f359f2f99 | | setup.mjs (in .vscode) | f525d52ceb966516686b482d3dc0137028cc6a63 |

Strings / Attribution Indicators

• `IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients`

Tags

#Research#Security

Continue reading

[](https://www.wiz.io/blog/supply-chain-readiness-blackhat-session-2026-practical-takeaways)

Supply Chain Readiness - BlackHat Session 2026 - Practical Takeaways

[](https://www.wiz.io/authors/yuval-dan)[](https://www.wiz.io/authors/shira-ayal)

Yuval Dan, Shira Ayal

August 3, 2026

Immediate recommendations and supply chain investigation playbook

[](https://www.wiz.io/blog/introducing-the-wiz-sensor-for-developer-workstations)

Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era

[](https://www.wiz.io/authors/shashank-golla)[](https://www.wiz.io/authors/shahar-yakov)[](https://www.wiz.io/authors/yoav-balasiano)

Shashank Golla, Shahar Yakov, Yoav Balasiano

August 3, 2026

As AI expands who builds software, the developer workstation is becoming a new security perimeter. AI and third-party software increasingly operate with access to your most sensitive credentials and cloud environments.

[](https://www.wiz.io/blog/s3-clones-in-the-neoclouds)

S3 Clones in the Neoclouds

[](https://www.wiz.io/authors/scott-piper)

Scott Piper

July 31, 2026

S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain.

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."

David EstlickCISO

"Wiz provides a single pane of glass to see what is going on in our cloud environments."

Adam FletcherChief Security Officer

"We know that if Wiz identifies something as critical, it actually is."

Greg PoniatowskiHead of Threat and Vulnerability Management

Get a demo