Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

MITRE Techniques

• [T1195.002] Compromise Software Supply Chain – The threat actor altered npm packages in the release process to distribute malicious code (‘published with a malicious preinstall hook’ and ‘republishes trojanized versions of other packages’).
• [T1546.016] Installer Packages – The malware executed during installation through npm lifecycle scripts (‘preinstall’: ‘node setup.mjs’ and ‘delivered entirely through the npm lifecycle’).
• [T1059.001] Command and Scripting Interpreter: JavaScript – The payload used Node.js and Bun scripts to run both stages (‘setup.mjs is a lightly obfuscated Node script’ and ‘execFileSync(bunBinary, [payloadPath])’).
• [T1105] Ingress Tool Transfer – The loader downloaded a standalone Bun runtime from GitHub to execute the second stage (‘downloads a platform-matched standalone Bun runtime’).
• [T1552] Unsecured Credentials – The payload searched for and collected cloud, CI, and developer secrets (‘harvests cloud and CI credentials’, ‘AWS/GCP/Azure keys’, ‘HashiCorp Vault tokens’, ‘Kubernetes service account tokens’, ‘npm tokens’).
• [T1530] Data from Cloud Storage – The collector queried cloud instance metadata and credential sources from cloud environments (‘queries the AWS instance metadata service’ and reads ‘AWS credential chains and Secrets Manager’).
• [T1213] Data from Information Repositories – It pulled secrets and tokens from GitHub and repository-related sources (‘enumerates GitHub Actions organization and repository secret metadata’ and commits stolen findings to GitHub repositories).
• [T1027] Obfuscated Files or Information – Strings in the second stage were protected with polymorphic basE91 encoding (‘Strings are protected with polymorphic basE91 encoding’).
• [T1071.001] Application Layer Protocol: Web Protocols – The malware used HTTPS, GitHub APIs, and npm registry endpoints for command, credential exchange, and publishing (‘downloads … over HTTPS’, ‘POST /user/repos’, ‘registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/’).
• [T1567.002] Exfiltration to Cloud Storage – Stolen data was sent to threat actor GitHub repositories (‘commits stolen findings using the GraphQL createCommitOnBranch mutation’).
• [T1102.001] Web Service: Dead Drop Resolver – The DomainSender resolved destinations via DNS before sending data (‘resolves destinations via DNS and health-checks them before sending encrypted data’).
• [T1547.001] Registry Run Keys / Startup Folder – Persistence was added through autostart hooks in repository and system startup locations (‘plants autostart hooks in .claude and .vscode’ and persists as a LaunchAgent or systemd user service).
• [T1490] Inhibit System Recovery – The dead-man’s switch triggered destructive cleanup on token revocation, removing its own state and exiting (‘when the token stops working … it evaluates a remote-supplied handler string, then deletes its state and exits’).