Supply chain attack hits keyv and cacheable npm packages, stealing cloud credentials

A supply chain attack compromised the npm packages keyv and cacheable, along with several related libraries, after the Jaredwray maintainer account was taken over by a threat actor. At least ten packages were published containing a malicious preinstall hook that downloads a Bun runtime and runs an obfuscated payload to steal cloud, CI, GitHub, and Kubernetes credentials. The stolen credentials were then used to republish additional trojanized npm packages, with evidence suggesting at least one account outside the keyv and cacheable ecosystems was also affected. The compromised packages collectively receive tens of millions of weekly downloads and are often installed indirectly — for example, through the dependency chain eslint → file-entry-cache → flat-cache → keyv. Security researchers flagged affected packages within minutes of publication, and an ongoing list of impacted artifacts is being maintained by Socket.dev.