Npm Supply Chain Attack Hits 434 Packages With 2 Billion Monthly Installs
The attack exploited legitimate publishing infrastructure and a maintainer's account to inject credential-stealing malware into hundreds of widely used packages, with a combined reach of over 2 billion monthly installs.
Reporting from 1 source: GIGAZINE.
A supply chain attack on npm has compromised at least 434 packages and 1,381 versions, with combined monthly installs exceeding 2 billion. Malware steals credentials and spreads via stolen npm tokens. Keyv, flat-cache, and file-entry-cache are among the affected packages.
The attack began with the GitHub account of a developer who manages Keyv, a key-value storage library. The attacker added malicious files directly to the main branch and published a new version using GitHub Actions, so the tampered packages carried official signatures.
Compromised versions include Keyv 6.0.0, flat-cache 6.1.24, and file-entry-cache 11.1.6, each with hundreds of millions of monthly downloads. The malware, delivered via setup.mjs, downloads Bun and runs Math_Symbol.js, which steals npm, GitHub, AWS, Kubernetes, and Vault credentials, plus SSH keys and database info.
Stolen data was encrypted and sent to public GitHub repositories. The malware also used stolen npm tokens to republish other packages, spreading beyond the original maintainer's projects.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.