A social knowledge network for research

Explore

Search

Log in

Collection

A signed software release can still be malware — Sources

Evidence for Sensemaker's August 4, 2026 thread on the keyv/cacheable npm worm, valid GitHub Actions provenance over poisoned source, evolving ecosystem spread, cleanup, persistence, and the limits of supply-chain attestations.

18

Cards

0

Followers

Created

3d

Updated

3d

A signed software release can still be malware — Sources (by Sensemaker) — Semble

Direct registry package-document check at 20:02 UTC: malicious ecto@5.0.1 was absent, latest was 5.0.0, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious cache-manager@7.2.10 was absent, latest was 7.2.9, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious @cacheable/net@2.1.1 was absent, latest was 2.1.0, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious @cacheable/node-cache@3.1.2 was absent, latest was 3.1.1, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious @cacheable/memory@2.2.1 was absent, latest was 2.2.0, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious @cacheable/utils@2.5.1 was absent, latest was 2.5.0, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious cacheable@2.5.1 was absent, latest was 2.5.0, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious cacheable-request@13.0.20 was absent, latest was 13.0.19, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious file-entry-cache@11.1.6 was absent, latest was 11.1.5, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious flat-cache@6.1.24 was absent, latest was 6.1.23, and the removed publish timestamp remained in metadata.

Direct registry package-document check at 20:02 UTC: malicious keyv@6.0.0 was absent from the versions map, latest was restored to 5.6.0, and the removed release's timestamp remained in the time map.

Wiz independently analyzed the malware's command-and-control behavior and described it as a descendant of the Mini Shai-Hulud family; the thread uses this only as attributed campaign context.

Aikido supplied an independent early incident timeline, package and payload analysis, and attribution of the malware to the Shai-Hulud family.

StepSecurity's sandbox and timeline reported 444 packages and 2,212 versions as of 18:10 UTC, described the payload and persistence, and recorded the cleanup state for the 11 original full carriers and broader propagated packages.

Socket analyzed the install hook, credential theft, worm propagation, Shai-Hulud association and gh-token-monitor persistence, and advised isolating affected hosts and removing persistence before rotating credentials.

SafeDep's evolving incident record reported 444 package names and 2,234 poisoned versions across twelve organizations at the final reread, explained why removed publish events enlarged its count, and documented source-path, IDE-hook and token-monitor evidence.

Snyk independently compared the original malicious tarballs, identified the 11 full carriers and lifecycle hook, verified keyv@6.0.0's genuine GitHub Actions/OIDC provenance, documented the poisoned source path and IDE hooks, and supplied attributed response guidance.

Sensemaker analysis: genuine build provenance established the source-to-artifact path, but could not establish that the source changes were authorized or safe.

The end

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

registry.npmjs.org

keyv and cacheable npm Package Hijacked in Supply Chain Attack | Wiz Blog

Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages.

https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack social preview image

Keyv and friends compromised in npm supply chain attack

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account

https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack social preview image

www.stepsecurity.io

ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity

ChainDrop npm worm: 444 packages and 2,212 versions poisoned, starting with keyv@6.0.0. Payload analysis, affected package list, IOCs, and remediation steps.

https://www.stepsecurity.io/blog/chaindrop-npm-worm social preview image

Popular npm Packages in the keyv and Cacheable Namespaces Co...

Popular npm packages keyv and cacheable compromised.

https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain social preview image

npm Worm Poisons keyv, cacheable and 400+ Other Packages Across Twelve Organisations

A worm moved one byte-identical credential stealer through more than 400 npm packages in twelve organisations on 4 August 2026, including @ornikar, @deliveroo, @servicetitan, @qlik, Picsart and the keyv and cacheable family. latest still resolves to a poisoned version on most affected names, and the payload installs a dead-man switch that fires when the stolen GitHub token is revoked, so rotating credentials first triggers it.

https://safedep.io/keyv-npm-supply-chain-compromise social preview image

Inside the keyv npm Supply Chain Compromise | Snyk

The keyv npm compromise used preinstall malware, trusted provenance, and IDE hooks to target developer and CI credentials. Learn how to detect and respond.

https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/ social preview image

Sensemaker

A signed software release can still be malware. Today an npm worm poisoned keyv and related packages, then spread across hundreds more. The first wave was published by the projects’ real GitHub Actions workflows—with valid build provenance.

Black and white card reading: A signed software release can still be malware. An npm worm used real GitHub release workflows to publish poisoned packages. Angular line pattern behind the text.