NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downloads and Spreads to Hundreds of Packages

What we know so far

Early on August 4, malicious versions appeared under the jaredwray / Cacheable ecosystem. The first wave was published through the project's legitimate GitHub Actions OIDC trusted publishing pipeline after a commit to main added a preinstall hook and two payload files. Those tarballs carry valid npm signatures and SLSA provenance.

The seed packages in that wave alone account for ~515 million weekly downloads (npm last-week API, August 4, 2026). Just three of them (keyv, flat-cache, file-entry-cache) exceed 450 million weekly downloads. Those figures sum package-level traffic and overlap in dependency trees, but they show how wide the first wave's reach is.

The campaign then spread to other maintainers' packages, typically via stolen npm publishing tokens and without provenance. As of this writing we have verified 384 packages and 1,136 malicious versions linked by a shared stage-2 payload. Treat those numbers as a floor. The list is still growing.

Affected packages

We have verified 1,136 malicious versions across 384 packages as of writing this blog post. The seed packages listed below carry the overwhelming majority of download traffic, but the full campaign spans hundreds of lower-traffic packages republished under compromised maintainer accounts. Because versions are actively being unpublished and new ones keep appearing, treat the list as a point-in-time snapshot for August 4, 2026, and as a floor rather than a final total.

• Update 2026-08-04 11:00 PDT: Refreshed list to reflect 1,136 malicious versions across 384 packages

The complete verified list of affected package versions is embedded below.

Highest-impact seed packages

These packages drive most real-world exposure. flat-cache and file-entry-cache sit in the ESLint dependency chain, so many projects pull them in transitively (often as dev dependencies only). That does not reduce risk: the malware runs on npm install.

Weekly downloads from the npm downloads API (last-week, as of August 4, 2026):

Several of these versions have already been unpublished. Do not treat "latest looks clean" as proof you never installed a bad version. Check lockfiles and CI logs.

Spread beyond the seed wave

After the initial Cacheable / jaredwray wave, the same payload was republished under multiple unrelated maintainer accounts, including several belonging to established software organizations. The pattern is consistent across them: an npm publishing token was stolen and used to push malicious versions, in most cases a CI or service-account token likely harvested from a build runner that had itself installed a poisoned dependency.

Notably, some of the malicious versions were published under the npm scopes of legitimate, well-known software companies, using their own maintainer or CI credentials. Verified examples include @servicetitan/* (ServiceTitan), @ornikar/* (Ornikar), @onereach/* and @or-sdk/* (OneReach), @qlik/* and @nebula.js/* (Qlik), @hubsync/* (HubSync), @picsart/* (Picsart), @arv-bedrock/* (Bedrock Analytics), and @adminide-stack/* (CDMBase). In each case the scope was abused through a stolen publishing token, not through any compromise of the company's own systems, and the packages have been reported to npm and the affected maintainers.

Attack chain (summary)

Every confirmed malicious version adds:

"scripts": {
  "preinstall": "node setup.mjs"
}

setup.mjs is an obfuscated dropper. It downloads a unmodified Bun 1.3.13 binary from official GitHub releases, then uses Bun to execute a ~727 KB obfuscated stage-2 payload shipped in the package (Math_Symbol.js in the first wave, math_init.js later). The two filenames are byte-identical.

Using Bun means the malware brings its own runtime and does not need a malicious download domain for the executor. The only network fetch in stage 1 is a legitimate Bun release.

Intial analysis of the payload confirms targeting of AWS credentials, npm tokens, GitHub tokens (including ghs_ Actions / App tokens), and HashiCorp Vault tokens. The bundle also includes packaging and npm publish machinery that matches the self-propagation we observed across maintainer accounts.

Indicators of compromise

What to do now

1. Pin or roll back affected packages to versions published before 2026-08-04 09:30 UTC.
2. Use npm/yarn/pnpm overrides for keyv, flat-cache, and file-entry-cache. They are usually transitive.
3. Search lockfiles and CI logs for malicious versions, including devDependencies.
4. Rotate credentials on any machine or runner that ran npm install after 09:30 UTC: npm tokens, GitHub PATs, cloud keys, CI secrets, Vault tokens.
5. Prefer --ignore-scripts in CI. It blocks this class of install-hook malware.

We are tracking this

Endor Labs is verifying new publishes, updating affected-package coverage as versions appear, and preparing a full technical write-up of the loader, worming behavior, and infra. This is an initial advisory while the campaign is ongoing. We will expand with in-depth technical analysis in a follow-up post.