Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

At least 10 npm packages in the keyv and cacheable namespaces were compromised on August 4, 2026 with malicious preinstall hooks that download Bun runtime, steal cloud/CI credentials, and propagate via stolen npm tokens. Tens of millions of weekly downloads are affected through transitive dependencies. Any organization using these packages or their dependents is at immediate risk of credential theft and supply chain propagation.

CRITICALAdvisoryAug 06, 2026

Action required

Immediately audit npm dependencies for keyv and cacheable packages; if present, revoke all npm tokens, cloud credentials, and CI/CD secrets that could have been accessed during installation; scan build logs and package-lock files for suspicious preinstall activity dating back to August 4, 2026.

Affected products

keyvcacheablecacheable-requestflat-cachefile-entry-cache

Linked articles

Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

Source links

https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain?utm_medium=feed