Keyv & Cacheable NPM Packages in Ongoing Supply Chain Attack

Executive Summary

On August 4^th, 2026, a supply chain attack was identified on two npm packages, Keyv and Cacheable by Wiz Research. Keyv and Cacheable are very popular JavaScript libraries with over 150 million weekly downloads and are used in many JavaScript deployments. Multiple malicious packages within the Keyv/Cacheable system were published via a compromised GitHub maintainer account to deploy a variant of the Shai-Hulud malware family.

The malware collects a broad range of credentials used to publish future npm packages within a continuous integration / continuous deployment (CI/CD) pipeline, including personal and production credentials to facilitate further propagation. These secrets were exfiltrated using the description “Shai_Hulud: Here We Go Again” with the commit message “IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients”.

Organizations that are affected should immediately audit their environments to confirm whether any identified npm packages were installed. If so, treat the machine as compromised and follow the Mitigations and Workarounds section below.

Affected Systems and Products

Mitigations and Workarounds

Affected organizations should block the following command-and-control endpoints identified used for this attack:

• ‍npm-cache[.]com - 104.21.35[.]216
• eth-mainnet.nodereal[.]io - 35.175.164[.]77
• go.getblock[.]io - 185.44.207[.]215
• eth.llamarpc[.]com - 172.67.167[.]200
• pypi-get[.]com - 172.67.136[.]8, 104[.]21.54.63
• js-mirror[.]com - 104.21.88[.]80, 172.67.174[.]77

If you believe that a machine has already been compromised, we do not advise cleaning in place and instead recommend reimaging or rebuilding affected machines from known good images.

Using pinned versions of libraries is also recommended to prevent this kind of attack if new malicious versions are released for any library.

Additionally, npm offers a npm config set min-release-age 3 configuration setting that will enforce a 48 to 72-hour delay on new package releases before installing them on your machine. This is advised for all developers using external packages. For machines running without human interaction, such as CI/CD pipelines, we advise not only pinning package versions but also disabling scripts on installation with the --ignore-scripts argument wherever possible.

Patches

While not strictly a patch, affected npm packages should be removed and purged from impacted machines. This involves removing the affected packages and installing pinned versions of the unaffected npm package with these commands:

• ‍rm -rf node_modules/plain-crypto-js
• npm install --ignore-scripts
• npm cache clean --force

Indicators of Compromise

Network Activity

The following domains and IP addresses have been associated with malicious activity observed during this campaign.

Wiz Research has also identified the user-agent performing malicious calls as Bun/1.3.13

Files

The following file names and hashes have been identified as part of the malware’s execution.

How Beazley Security is Responding

Beazley Security is conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources

• ‍www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack‍
• https://github.com/wiz-sec-public/wiz-research-iocs/blob/main/reports/keyv-packages.csv