As cited
Copy frozen at (site build).
threat intel
Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm
On August 4, 2026, attackers compromised the widely-used keyv and cacheable npm packages and published trojanized versions that execute a credential-stealing worm on install. The malware harvests cloud keys, GitHub tokens, and npm credentials, then uses stolen tokens to automatically inject itself into hundreds of other packages. The payload installs a persistence mechanism that monitors the GitHub token and triggers an attacker-controlled command if the token is revoked, making standard remediation steps potentially dangerous.
Why it matters: Development teams and security responders need to avoid revoking tokens immediately when discovering this compromise, as the dead-man's switch will execute unknown attacker code upon revocation; additionally, repositories checked out for investigation or opened by AI agents can trigger the malware without npm install, expanding the blast radius beyond typical build environments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm
On August 4, 2026, an attacker compromised the maintainer accounts for keyv and cacheable npm packages and published trojanized versions containing a preinstall hook that harvests credentials, injects itself into other packages via a stolen npm token, and spreads as a worm across 440+ packages. The payload also plants IDE autostart hooks that execute when a repository is opened without npm install, and installs a persistent dead-man's switch that monitors the stolen GitHub token and executes an attacker-controlled handler if the token is revoked.
Why it matters: Teams using keyv, cacheable, or any of the 440+ affected packages across thousands of versions face credential compromise and supply chain worm propagation; the dead-man's switch means revoking compromised tokens triggers an unknown remote payload, making remediation strategy critical and requiring coordination beyond standard incident response.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm
On August 4, 2026, an attacker compromised the maintainer accounts for keyv and cacheable npm packages and published trojanized versions containing a preinstall hook that harvests credentials, injects itself into other packages via a stolen npm token, and spreads as a worm across 440+ packages. The payload also plants IDE autostart hooks that execute when a repository is opened without npm install, and installs a persistent dead-man's switch that monitors the stolen GitHub token and executes an attacker-controlled handler if the token is revoked.
Why it matters: Teams using keyv, cacheable, or any of the 440+ affected packages across thousands of versions face credential compromise and supply chain worm propagation; the dead-man's switch means revoking compromised tokens triggers an unknown remote payload, making remediation strategy critical and requiring coordination beyond standard incident response.
- Source published
- First seen by Cybersecurity Tracker