Popular npm packages in the keyv and cacheable namespaces compromised in active supply chain attack

A compromised maintainer account shipped malicious releases of keyv, the @keyv and cacheable families, flat-cache, file-entry-cache, and others, using a preinstall hook that downloads a standalone Bun runtime and runs an obfuscated payload. The payload harvests cloud and CI credentials (AWS, GCP, Azure, Kubernetes, GitHub Actions OIDC, npm tokens), then self-propagates by republishing other packages with the same hook using the stolen npm tokens. Two details stand out to us. The persistence layer plants autostart hooks in .claude and .vscode directories, explicitly targeting developer machines and AI coding agents as an execution surface. And remediation is order-sensitive: Socket advises removing the host-level dead-man's switch watching stolen GitHub tokens before rotating credentials, or the rotation itself tips off the attacker. This is the maintainer-account attack class the npm hardening measures we logged earlier are aimed at; install-script-off-by-default cannot come fast enough. We audited our own lockfiles against the affected list the day we read it, and would suggest the same to anyone.