Supply Chain Attack: Detecting and Mitigating Hijacked keyv and cacheable npm Packages

Wiz Research is actively investigating a critical software supply chain attack affecting multiple packages within the keyv and cacheable npm ecosystem. Attackers have successfully hijacked these popular libraries, widely used for key-value storage and caching in Node.js applications. This ongoing campaign poses a severe risk of Remote Code Execution (RCE) in development environments, CI/CD pipelines, and production workloads. Defenders must act immediately to identify compromised dependencies and contain potential breaches.

Technical Analysis

Affected Products and Ecosystem: The attack targets the keyv package and its numerous adapters (e.g., @keyv/redis, @keyv/memcache, @keyv/sqlite, @keyv/postgres), as well as the cacheable package. These libraries are foundational dependencies for countless Node.js applications, meaning a single compromise can propagate downstream through the dependency tree.

Attack Vector and Mechanics: The attackers published malicious versions of these packages to the npm registry. The core mechanism of exploitation relies on the execution of arbitrary code embedded within the package's lifecycle scripts (such as preinstall, install, or postinstall). When a victim—either a developer running npm install or an automated build pipeline—installs the compromised package, npm automatically executes these scripts with the permissions of the current user. This results in the immediate execution of malicious payloads on the host system.

Impact and Exploitation Status:

• Impact: Successful exploitation grants the attacker command-and-control (C2) capabilities, allowing for data exfiltration, credential theft from build environments, and lateral movement.
• Exploitation Status: Confirmed active exploitation in the wild. The attack is currently ongoing, and telemetry suggests widespread installation attempts.

Detection & Response

SIGMA Rules

The following Sigma rules detect suspicious child processes spawned by the npm package manager, a common TTP for malicious package execution.

---
title: Suspicious Shell Spawned by NPM or Node
id: 8d4f9a12-3b5c-4d8e-9f1a-2b3c4d5e6f7a
status: experimental
description: Detects when npm or node processes spawn a shell (bash, sh, powershell), which is indicative of a malicious package execution script.
references:
  - https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '\node.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts requiring shell access
level: high
---
title: NPM Process Spawning Network Utility
id: 9e5g0b23-4c6d-5e9f-0g2b-3c4d5e6f7g8h
status: experimental
description: Detects npm or node spawning network tools like curl or wget, often used in malicious supply chain payloads to fetch stage-2 payloads.
references:
  - https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/npm'
      - '/node'
    Image|endswith:
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Legitimate build scripts downloading resources
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts for anomalous process executions initiated by package managers, focusing on the keyv and cacheable context or general shell spawning behavior.

// Hunt for npm spawning shells or network tools
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in ('npm', 'node', 'npm.cmd', 'node.exe')
| where FileName in ('sh', 'bash', 'powershell.exe', 'cmd.exe', 'pwsh', 'curl', 'wget')
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName, FolderPath
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for processes that were spawned by npm, specifically looking for interactive shells or network utilities indicative of malicious post-install scripts.

-- Hunt for suspicious child processes of npm
SELECT Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.Cmdline AS ParentCmd,
       Pid, Name, Cmdline, Username, StartTime
FROM pslist()
LEFT JOIN pslist() AS Parent ON Parent.Pid = Ppid
WHERE Parent.Name =~ 'npm'
   AND (Name =~ 'sh' OR Name =~ 'bash' OR Name =~ 'curl' OR Name =~ 'wget' OR Name =~ 'powershell')

Remediation Script (Bash)

This script audits the package-lock. for known vulnerable packages (listed in the Wiz advisory) and forces a clean installation.

#!/bin/bash

# Audit keyv and cacheable packages for compromise
echo "[*] Auditing npm environment for keyv/cacheable supply chain compromise..."

# Check for the presence of the specific packages in package-lock.
if [ -f "package-lock." ]; then
  echo "[+] Checking package-lock. for keyv or cacheable dependencies..."
  if grep -q '"keyv"' package-lock. || grep -q '"cacheable"' package-lock.; then
    echo "[!] DETECTED: keyv or cacheable packages found in dependency tree."
    echo "[*] Action: Review versions against Wiz Research advisory."
    # Force update to latest safe version (post-incident)
    echo "[*] Attempting to force update to latest safe versions..."
    npm update keyv cacheable
    npm audit fix --force
  else
    echo "[OK] No direct keyv/cacheable dependencies found in lock file."
  fi
else
  echo "[!] No package-lock. found in current directory."
fi

# Clear npm cache to prevent re-installation of cached malicious tarballs
echo "[*] Clearing npm cache..."
npm cache clean --force

echo "[*] Remediation actions complete. Please rotate any credentials exposed during this window."

Remediation

1. Update Affected Packages: Immediate upgrade of keyv, cacheable, and all associated @keyv/* packages is required. Ensure you are pulling the latest patched versions from the npm registry.
2. Review package-lock.: Manually inspect your lock files to ensure resolved versions match the patched releases listed in the official Wiz Research advisory.
3. Invalidate Build Caches: CI/CD pipelines often cache dependencies. Clear all pipeline and runner caches to ensure the compromised package versions are not re-used in future builds.
4. Credential Rotation: Treat the environment as compromised if the malicious packages were executed. Rotate all secrets (API keys, database credentials, cloud tokens) accessible to the CI/CD pipeline or development workstations during the infection window.
5. Vendor Advisory: Continuously monitor the Wiz Research Blog and the official npm advisory for the latest list of malicious version hashes and safe versions.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub