Overview
- Security researchers reported that on Tuesday, August 4, 2026 attackers used a compromised maintainer GitHub account to push malicious commits and publish poisoned npm releases across the Keyv/Cacheable package family.
- Each affected release added setup.mjs and Math_Symbol.js and a preinstall script so that npm install runs a dropper that fetches Bun and launches a large obfuscated payload.
- The payload, linked by multiple firms to the Shai-Hulud/ChainDrop family, harvests a wide range of secrets including npm and GitHub tokens, OIDC tokens, AWS keys, Kubernetes and Vault secrets, and can republish packages using stolen publishing access.
- Reported scope varies across vendors from several hundred artifacts to more than 1,200 affected packages, and many poisoned releases carried valid GitHub Actions provenance which complicates trust and remediation.
- Responders should treat any workstation or CI runner that executed an affected version as compromised, remove the versions, rotate exposed tokens and keys, inspect repositories for unauthorized commits, and rebuild or restore systems from clean backups.