The Commit Said claude: Inside the Keyv and Cacheable NPM Worm's Trust Chain Abuse

Most npm supply chain writeups this year have followed a familiar shape: a preinstall script, a credential stealer, a blocklisted domain. The keyv and cacheable compromise that started August 4, 2026 follows that shape too, but two details separate it from the pack and are worth understanding on their own terms, not just as another entry in a growing list. First, the worm used a compromised maintainer's own credentials to generate a valid Sigstore provenance attestation for malicious code, which is a direct attack on the specific mechanism built to prevent this exact scenario. Second, it planted autostart hooks that fire specifically when a developer or an AI coding agent opens a cloned repository, and the commits that hook leaves behind are authored as claude.

How a legitimate build pipeline shipped malicious code with a valid signature

Sigstore exists to let a package consumer verify that a given release was actually built from the source it claims to be built from, closing the gap where a compromised registry account could publish something that never went through the real build process. The keyv attack did not need to defeat that verification, because it compromised the maintainer's GitHub account directly and pushed the malicious files straight to the main branch before the legitimate CI pipeline ever ran. The pipeline then built and signed exactly what it was given, which happened to already be trojanized. The resulting release, documented by Socket's research team, carried a technically valid attestation describing a build process that had, in fact, run correctly on malicious input. Provenance tooling verifies that the build happened as described. It cannot verify that the source fed into the build was trustworthy, and this attack is a clean demonstration of exactly that gap.

The propagation mechanism turned every maintainer account into a vector

Once the first release was live, the worm used stolen npm tokens and OIDC trusted publishing credentials, the same mechanism meant to let CI pipelines publish without long lived secrets, to push the same malicious hook into other maintainers' packages and republish them under those maintainers' own trusted identities. Aikido's analysis puts the scope at over 444 packages across 1,381 versions within a day, with a combined footprint above 2 billion monthly installs once the keyv family, cacheable family, and community packages that depend on them are counted. The payload itself downloads a standalone Bun runtime without checksum or signature verification and runs an obfuscated second stage that harvests npm, GitHub, AWS, GCP, Azure, Kubernetes, and HashiCorp Vault credentials, along with Stripe and Slack tokens and a generic regex sweep for private key material on disk. None of that is novel on its own. The scale it reached in roughly 24 hours, through legitimate publishing infrastructure rather than around it, is what makes this one worth a team's attention beyond the standard rotate your credentials advice.

Why the Ethereum fallback matters more than it sounds like it should

A hardcoded command and control domain is something defenders can get blocklisted or taken down through a registrar. This payload's fallback resolves its endpoint by querying an Ethereum smart contract, which lets the attacker change the destination without touching the payload itself and without depending on any single domain registrar's cooperation. Combined with a persistence mechanism, a macOS LaunchAgent or Linux systemd service polling the GitHub API roughly once a minute, the attack is built to survive the first round of a defender's response: blocking one domain or revoking one token does not remove the mechanism that can redirect to a new one.

Why the .claude hook is the detail that should change how you think about AI tool config

The propagation hook commits to up to 50 branches per compromised repository using a stolen token, authored as claude, with the commit message chore: update config, which is designed to blend into a repository's normal activity rather than stand out in a quick scan of commit history. The hooks it plants in .claude/settings.json and .vscode/tasks.json do not require a developer to run npm install at all. They fire the moment someone, or an AI coding agent acting on someone's behalf, opens the cloned repository, which means the actual trigger condition for this payload is broader than the standard install time execution most npm supply chain writeups describe. We covered a related but distinct pattern in the TensorLake compromise from October 8, where AI coding tool configuration files were explicitly named as a target rather than an incidental collateral hit. This attack predates that one by two months and establishes the same pattern earlier: configuration files that AI coding agents read on startup are now a recognized place to plant persistence, not a backwater a defender can safely ignore.

What to actually check and in what order

Check for the affected package versions directly: keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable 2.5.1, and cache-manager 7.2.10, along with the broader list Socket and Aikido continue to update. Look specifically for a preinstall entry running setup.mjs in any package.json in your dependency tree, and separately, regardless of whether you found that preinstall entry, check .claude/settings.json and .vscode/tasks.json in every repository your team has cloned recently for autostart hooks you did not add. Remove any persistence mechanism, the scheduled task or service polling a stolen token, before rotating credentials, since the specific design intent of that persistence layer is to survive a token rotation that happens while it is still running. Only after that removal is confirmed should you rotate npm, GitHub, cloud, and Vault credentials, and audit your own GitHub account for commits authored as claude that you did not make.

FAQ

Is this the same incident as the TensorLake npm compromise covered elsewhere on this site? No, though they are related. The keyv and cacheable compromise happened August 4, 2026, and is a different, larger scale incident. TensorLake, disclosed October 8, 2026, is a separate package compromise in the same Shai-Hulud attack lineage that explicitly named AI coding tool configuration files as a target, a pattern this earlier incident already established in practice.

How would I know if my team was affected without checking every dependency manually? Search your lockfiles for the specific affected versions listed above, and separately search your cloned repositories for the literal strings setup.mjs in a preinstall script and for unexpected entries in .claude/settings.json or .vscode/tasks.json, since either indicator can be present independent of the other.

Does removing the compromised package version also remove the implant? Not necessarily. If the preinstall script already ran, or if the configuration hook already fired, removing the package afterward does not remove whatever the payload already planted, including the persistence mechanism and any already exfiltrated credentials.

Why does the Ethereum smart contract detail matter for defenders specifically? It means blocking a known bad domain only stops the current configuration, not the attack. The attacker can redirect the command and control endpoint through the smart contract without changing the payload already deployed on compromised machines, so domain blocking alone is not a sufficient containment step.

When this applies to your stack

If your team runs npm install in any CI pipeline that has access to production or near production credentials, verify today whether preinstall and postinstall scripts are disabled by default, since that is the exact mechanism this entire attack family depends on. If your developers use Claude Code, Cursor, or similar tools with configuration or MCP files that grant access to real infrastructure, treat those files with the same handling discipline as a cloud credentials file, including auditing what currently lives in them and whether a compromised workstation would hand an attacker more than it should. Contra Collective helps engineering teams build that credential isolation into their development environment before an incident forces the audit.