Maintainer Compromise Poisons npm Caching Packages, Affecting 2 Billion Monthly Installs

A massive supply chain attack struck the npm ecosystem on August 4, 2026, after attackers compromised the GitHub account of a prominent maintainer. By hijacking this single point of trust, the actors injected credential-stealing malware into a family of widely used caching utilities, potentially exposing billions of developer environments to theft.

The breach targeted several high-traffic packages, most notably 'keyv', 'flat-cache', and 'file-entry-cache'. According to security firm Aikido, these three packages alone account for 619 million, 565 million, and 557 million monthly downloads, respectively. In total, the attack compromised at least 868 packages across 1,381 versions, impacting over 2 billion monthly installs.

The Infection Mechanism

The attackers utilized a two-stage execution process to bypass detection. The malware was triggered via a 'preinstall' script, which first executed a dropper named 'setup.mjs'. This dropper downloaded the Bun runtime to execute the primary payload, 'Math_Symbol.js'.

Once active, the payload functioned as a worm, spreading from the initial compromised packages to other maintainers' projects. The malware specifically targeted high-value secrets, exfiltrating npm registry auth tokens from .npmrc files, GitHub CLI tokens, HashiCorp Vault tokens, and AWS access keys located in ~/.aws/credentials.

Systemic Risks to CI/CD

This incident highlights the critical vulnerability of the 'maintainer trust' model in modern software development. Because the attackers gained control of the maintainer's GitHub account, they were able to push malicious code directly to the main branch and release signed versions through GitHub Actions. This ensured the poisoned packages possessed valid provenance, allowing them to bypass traditional security checks that rely on signature verification.

The targeting of cloud credentials—particularly AWS and Vault tokens—transforms a package compromise into a broader infrastructure threat. By stealing these keys, attackers can move laterally from a developer's local machine into production cloud environments, potentially compromising entire CI/CD pipelines.

Industry Outlook

Security researchers are now monitoring the extent of the worm's propagation. While the primary targets were caching utilities, the ability of the malware to jump between maintainer accounts suggests a systemic risk that extends beyond a single set of libraries. Developers are urged to rotate all registry and cloud tokens that may have been present on machines where these packages were installed. The industry continues to evaluate how to move beyond single-factor maintainer trust to prevent a single account takeover from impacting billions of users.