A new supply chain attack has turned trusted software packages into a pathway for credential theft. The campaign began after attackers compromised the maintainer account behind the widely used Keyv library, then leveraged that access to push malicious releases across an expanding list of projects. A poisoned dependency can thus reach devices without users ever visiting a suspicious website or opening a malicious attachment.
Socket reported 2,234 affected package artifacts across 444 unique packages while the activity was still spreading, highlighting how a single compromised maintainer can create significant downstream risks for teams worldwide relying on open-source code. Organizations can minimize future exposure by implementing multi-factor authentication for publishing accounts, utilizing short-lived and narrowly scoped automation credentials, and segregating build permissions from release permissions.
Here are some indicators of compromise (IoCs): - npm package keyv@6.0.0 Confirmed malicious release - npm file-entry-cache@11.1.6 Confirmed malicious release - npm cache-manager@7.2.10 Confirmed malicious release - npm cacheable-request@13.0.20 Confirmed malicious release - npm qlik/api@2.14.2 Confirmed malicious release - npm cacheable/memory Affected package identified in the campaign - npm cacheable/utils Affected package identified in the campaign - npm cacheable/net Affected package identified in the campaign - npm scope servicetitan/* More than 17 affected packages, including eslint-config, anvil-themes, table, form, and log-service Malicious files like setup.mjs have been launched via obfuscated preinstall hooks.
