← Back to feed
2026-08-17 Supply ChainMalicious Tool TLP:CLEAR

keyv/cacheable npm Worm Exploits AI Coding Assistant Persistence Hooks

Date: 2026-08-17
Tags: supply-chain, malicious-tool

Executive Summary

A malicious commit compromised the popular keyv npm package on August 4, 2026, leading to a worm that reached over 400 distinct npm packages via GitHub maintainer account compromise. The worm uniquely targets AI coding assistant persistence by planting hooks in .claude/settings.json and .vscode/tasks.json, triggering execution when developers or agents open a repository checkout.

Campaign Summary

FieldDetail
Campaign / Malwarekeyv/cacheable npm Worm
AttributionUnknown (GitHub maintainer account compromise) (confidence: low)
Targetnpm developers using keyv, cacheable, ecto, and dependent packages; AI coding assistant users (Claude Code, VS Code agents)
VectorMalicious npm package dependencies; lifecycle scripts and IDE hooks
Statusactive
First Observed2026-08-04

Detailed Findings

On August 4, 2026, a malicious commit (174f6a5) was identified in the GitHub repository of the popular keyv npm package; similar commits were pushed to jaredwray/cacheable and jaredwray/ecto. Starting at 09:00 UTC, the attacker first used a compromised identity to introduce IDE persistence payloads to the keyv repository, then shortly after published a new version containing the payload.

This incident opens a new attack chapter at 'repo-open time,' with the malicious commit planting .claude/settings.json session hooks and .vscode/tasks.json folder-open tasks, so the trigger is a developer or coding agent opening the checkout. The 11 KB setup.mjs file is lightly obfuscated and configured to start a second stage under the Bun runtime.

Analysis identified the user-agent Bun/1.3.13 performing malicious calls, and the malware uses an Ethereum smart contract to dynamically retrieve C2 domains. Early enumeration found 11 malicious releases across the keyv family, the cacheable family, and ecto.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195.001Compromised GitHub maintainer credentials used to publish trojanized packages
Persistence: Boot or Logon Init ScriptsT1547.001IDE hooks (.claude/settings.json, .vscode/tasks.json) execute on repository open
Execution: Command and Scripting InterpreterT1059.001Malicious lifecycle scripts and Bun-based payload execution
Command and Control: Dynamic ResolutionT1568Ethereum smart contract used to retrieve C2 domains dynamically

IOCs

Domains

_Over 400 distinct npm packages compromised per Wiz tracking; specific version and hash IOCs published by Wiz and Datadog Security Labs_

Full URL Paths

_Over 400 distinct npm packages compromised per Wiz tracking; specific version and hash IOCs published by Wiz and Datadog Security Labs_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

{'name': 'keyv', 'registry': 'npm', 'version': '', 'note': 'Malicious versions published via compromised maintainer; Wiz identified 11 malicious releases across keyv, cacheable, ecto families'}
{'name': 'cacheable', 'registry': 'npm', 'version': '', 'note': 'Part of keyv worm propagation'}
{'name': 'ecto', 'registry': 'npm', 'version': '', 'note': 'Part of keyv worm propagation'}

Affected Platforms

npm registry
Claude Code (Anthropic)
VS Code

Detection Recommendations

Monitor npm audit logs and lockfile changes for unexpected updates to keyv, cacheable, ecto, and their dependents. Inspect .claude/settings.json and .vscode/tasks.json in all cloned repositories for malicious hook definitions. Block or sandbox Bun runtime execution during npm install unless explicitly required. Implement npm lifecycle script restrictions (--ignore-scripts). Track GitHub Personal Access Token (PAT) usage for keyv and related projects; rotate all maintainer credentials. Review GitHub Actions workflows for unauthorized commits or force-push activity on July 31–August 4, 2026. Alert on postinstall and preinstall script execution in package manager logs. Implement registry-level signature verification for npm package integrity.

References