Upwind Safety was first to report a provide chain compromise in keyv, some of the closely depended-upon packages within the npm registry, after figuring out a malicious launch that executes attacker-controlled code at set up time.
The compromised launch introduces a preinstall lifecycle hook. That hook fires throughout set up, earlier than any developer has the chance to examine what arrived in node_modules. It runs an obfuscated loader, which retrieves the Bun JavaScript runtime from GitHub Releases and makes use of it to launch a bundled payload constructed for credential assortment.
What the Payload Collects
Upwind’s evaluation identifies the gathering scope throughout the credential sorts that carry essentially the most weight in a contemporary construct setting: AWS keys, GitHub tokens, npm registry credentials, and HashiCorp Vault tokens. The harvesting runs on developer workstations and inside CI/CD environments with out distinction.
Upwind’s Mixed Incident Report scores the marketing campaign at 92 total. Influence sits at 93, proof at 95, sophistication at 88. The classification is malicious reasonably than suspicious, which displays confirmed payload habits reasonably than heuristic detection.
The report is unambiguous about what an set up means. In Upwind’s phrases, “Any machine that ran npm set up towards an affected package deal model has already executed attacker-controlled code with the privileges of the putting in consumer.”
Eight Packages, A number of Namespaces
keyv was the entry level reasonably than the boundary. Upwind documented similar malicious payloads throughout eight releases:
- keyv@6.0.0
- @cacheable/node-cache@3.1.2
- cacheable@2.5.1
- file-entry-cache@11.1.6
- @cacheable/utils@2.5.1
- @cacheable/reminiscence@2.2.1
- cache-manager@7.2.10
- flat-cache@6.1.24
The unfold covers the whole @cacheable ecosystem alongside keyv, flat-cache, and cache-manager. On how a single actor reached throughout separate maintainer namespaces concurrently, Upwind’s report describes the breadth as suggesting “both a coordinated multi-account compromise or a single risk actor with entry to the @cacheable, keyv, and associated ecosystems.”
Downstream publicity extends previous direct customers. Upwind names ESLint customers particularly, since flat-cache and file-entry-cache sit inside that toolchain, together with any challenge relying on keyv, flat-cache, or cache-manager.
Indicators of Compromise
Three artifacts establish an affected set up. The recordsdata setup.mjs and Math_Symbol.js seem in package deal contents the place no respectable caching library would place them. The command node setup.mjs seems within the manifest because the preinstall entry.
Upwind characterizes the install-time element as an opaque script of roughly 30KB that masses a 728KB payload. The dimensions hole issues. The seen portion is sufficiently small to outlive a fast look at a diff. The code that really executes arrives individually.
4 strategies seem in Upwind’s evaluation: preinstall hook abuse, obfuscated payload supply, patch-version camouflage, and credential harvesting at set up time. Patch-version camouflage deserves specific consideration. A number of poisoned releases sit a single increment above a clear model, which is precisely the form of bump automated dependency tooling approves with out human evaluate.
Upwind lists the probably exfiltration set as “setting variables, AWS/cloud credentials, SSH keys, and system reconnaissance information.”
Remediation
Upwind’s steerage for affected groups follows 4 steps.
Pin or downgrade affected packages instantly. Lock them to the final known-good model within the lockfile, then block compromised variations on the registry or firewall stage.
Rotate all credentials on uncovered techniques. Any machine or CI/CD runner that put in an affected model ought to be handled as compromised. AWS keys, SSH keys, API tokens, and setting secrets and techniques all fall in scope.
Disable npm set up scripts in CI/CD. Including the ignore-scripts flag to put in invocations in pipelines prevents preinstall and postinstall hooks from executing with out specific evaluate.
Audit put in packages for malicious recordsdata. Scanning node_modules for setup.mjs or Math_Symbol.js surfaces the compromise immediately, since neither file is a respectable element of any caching library.
Upwind moreover advises reviewing lockfiles and SBOMs for the affected launch. A model resolved and recorded weeks in the past will reintroduce the package deal on the subsequent clear construct no matter what the registry presently serves.
A Second Marketing campaign, Similar Technique
Upwind documented a parallel npm compromise utilizing the identical supply chain towards a special ecosystem. Eight packages throughout the Qlik and nebula.js scopes had been backdoored: @nebula.js/sn-line-chart@2.7.1, @qlik/sdk@0.28.1, @nebula.js/stardust@7.1.2, @nebula.js/cli@7.1.2, @qlik/browserslist-config@3.0.2, @nebula.js/cli-build@7.1.2, @nebula.js/cli-serve@7.1.2, and @nebula.js/cli-sense@7.1.2.
That report scores 94 total, with affect at 95 and proof at 97. A preinstall hook fires setup.mjs, which fingerprints host working system and structure, downloads Bun v1.3.13 from GitHub when absent, and executes a 727KB payload named math_init.js with full user-level filesystem and community entry. Upwind’s learn on the entry required is that the breadth of affected packages “suggests the attacker had write entry to the whole Qlik/nebula.js npm group.”
The Attain Drawback
keyv attracts roughly 154 million weekly downloads. It operates as foundational infrastructure throughout 1000’s of JavaScript tasks, the overwhelming majority of which by no means reference it immediately. It arrives as a dependency of a dependency.
That construction is what separates this incident from the compromise of a package deal builders consciously chosen. Publicity is set by transitive decision, not by adoption. Upwind’s closing framing holds: extremely trusted, high-volume dependencies stay prime targets for provide chain attackers, and a single malicious launch can carry ecosystem-wide penalties.
