On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv, a key-value storage library with roughly 127 million weekly npm downloads, and injected credential‑stealing malware across the entire package family. The same maintainer owns cacheable (29M/month), flat‑cache (565M/month), file‑entry‑cache (557M/month) and other popular caching utilities, all swept up in the attack.

The poisoned versions were published to npm with valid GitHub Actions signatures, including keyv 6.0.0 (604M/month), flat‑cache 6.1.24 (580M/month), file‑entry‑cache 11.1.6 (571M/month) and dozens more. At least 868 packages (across 1381 versions) were compromised, totaling over 2 billion monthly installs.

Two new files, setup.mjs and Math_Symbol.js, plus a "preinstall" script, were added to each package.json. The obfuscated dropper downloads the Bun runtime and executes Math_Symbol.js, which harvests npm tokens, GitHub tokens, AWS credentials, Kubernetes secrets, Vault tokens, Stripe and Slack tokens, and other secrets via filesystem scans and API calls. The worm quickly propagated to other maintainers, affecting major organisations such as @deliveroo/reevent, @or-sdk/invitations, @picsart/ai-sdk and @qlik/embed-runtime, expanding the attack surface.

Aikido users can detect the issue as a 100/100 critical malware problem; non‑users can create a free account and trigger a manual rescan. Aikido Safe Chain intercepts npm, yarn, pnpm commands to block malicious packages before install.