Overview
- Researchers say the compromise began on Tuesday, August 4, 2026, when attackers gained access to the maintainer's GitHub account and published malicious releases across the Keyv/Cacheable package family.
- Every poisoned package added two files (setup.mjs and Math_Symbol.js) and a preinstall hook that runs setup.mjs, which downloads the Bun runtime and hands execution to the obfuscated Math_Symbol.js payload.
- The Math_Symbol.js bundle harvests many secrets, including npm tokens, GitHub tokens (including OIDC), GitHub Actions runner memory, AWS credentials via IMDS and Secrets Manager, Kubernetes and Vault tokens, SSH keys, Terraform state, Stripe and Slack keys, and other files.
- Aikido and Wiz report that the code includes worm-like propagation that republished malicious versions to other packages and that at least 868 packages across 1,381 versions were compromised, creating a blast radius measured in billions of monthly installs.
- Responders have published IOCs (including ETH RPC endpoints and an exfiltration domain) and advise removing affected versions from build and CI systems, treating hosts as potentially compromised, rotating or revoking exposed credentials, rebuilding compromised systems, and enabling stronger supply-chain controls as a longer-term fix.