🚨 Active npm supply-chain worm is stealing developer credentials and targeting Claude Code / VS Code environments 🚨

Active npm supply-chain worm is stealing developer credentials and targeting Claude Code / VS Code environments

Socket Security is tracking an active npm supply-chain attack discovered on August 4, 2026. It initially affected the widely used keyv and cacheable package families and has since spread to packages belonging to other maintainers.

The affected packages collectively receive tens of millions of downloads per week and are often buried deep inside dependency trees, meaning developers may have them installed without knowingly adding them. One example dependency path is:

eslint → file-entry-cache → flat-cache → keyv

At the time I’m posting this, Socket’s live tracker lists 2,236 affected package artifacts across 444 unique packages. That number may continue changing because this is an active, self-propagating campaign.

What the malware does

The compromised packages contain a malicious preinstall hook:

json "preinstall": "node setup.mjs"

When an affected package is installed with lifecycle scripts enabled, setup.mjs downloads a standalone Bun runtime and uses it to execute an obfuscated payload named Math_Symbol.js.

The package’s normal library code may still function correctly afterward, so the installation can appear successful even though the system has already been compromised.

The payload searches for and steals credentials including:

• npm publishing tokens
• GitHub tokens and CI credentials
• AWS credentials and instance metadata
• GCP service-account keys
• Azure client secrets
• HashiCorp Vault tokens
• Kubernetes service-account tokens
• Private keys, bearer tokens and other secrets found in files, environment variables or running processes

The stolen information is encrypted and exfiltrated through attacker-controlled GitHub repositories and destinations resolved through DNS.

It spreads like a worm

This is not limited to the original compromised packages.

After stealing an npm token, the malware discovers other packages the victim is authorized to publish. It downloads those packages, injects the same malicious hook and payload, increases the version number and republishes the infected versions using the victim’s own npm identity.

That is how the attack spread from the original keyv and cacheable maintainer into packages owned by other people and organizations.

It also targets AI coding agents and IDEs

The attackers planted additional execution hooks in the source repositories:

• .claude/settings.json containing a Claude Code SessionStart hook
• .vscode/tasks.json containing a VS Code folderOpen task
• math_init.js, containing the same malicious payload

These hooks can execute when a cloned repository is opened through an AI coding agent or trusted development environment, depending on the tool’s trust and approval settings.

That means an attacker may not need the developer to run npm install. Opening or trusting the repository in Claude Code or VS Code can provide a separate execution path.

To avoid confusion: this does not mean that reading this post, visiting the article or using an ordinary ChatGPT conversation infects your computer. The risk applies to developer machines, CI runners and AI coding environments that clone, open, trust or install compromised code.

Signed provenance did not guarantee safety

keyv@6.0.0 reportedly shipped with valid npm/Sigstore provenance because the legitimate release workflow built source code that had already been compromised.

The signature correctly proved which build system produced the package. It did not prove that the source code supplied to that build system was safe.

Important warning before rotating credentials

The malware installs a persistence mechanism described as a dead-man’s switch on macOS and Linux.

It creates a gh-token-monitor service that checks whether a stolen GitHub token is still valid. When the token is revoked or rotated and begins returning an HTTP 4xx response, the monitor executes an attacker-supplied command.

Potential indicators include:

text ~/.local/bin/gh-token-monitor.sh ~/.config/gh-token-monitor/ ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.config/systemd/user/gh-token-monitor.service /tmp/gh-token-monitor.out.log /tmp/gh-token-monitor.err.log

Other files and activity to investigate include:

text setup.mjs Math_Symbol.js math_init.js bun-dl-* .claude/settings.json .vscode/tasks.json

Do not blindly begin rotating credentials from a machine that may be infected. Isolate the system and remove the monitor and malicious payload first. Credential rotation should then be performed from a separate, known-clean device.

Recommended precautions

• Avoid updating or installing affected packages until the situation is resolved.
• Pin dependencies to exact known-safe versions rather than using caret or tilde ranges.
• Rebuild and review lockfiles.
• Check Socket’s live campaign tracker instead of relying on a static package list.
• Temporarily install dependencies using:

bash npm ci --ignore-scripts

or:

bash npm install --ignore-scripts

The --ignore-scripts option prevents npm lifecycle hooks such as preinstall and postinstall from running automatically. It may also prevent legitimate packages from completing necessary setup steps.

It does not protect against the separate .claude or .vscode repository hooks.

Before opening an unfamiliar repository locally, inspect:

text .claude/settings.json .vscode/tasks.json package.json

Do not automatically trust unknown workspaces or approve unexpected startup hooks.

Anyone who installed an affected release with lifecycle scripts enabled, executed the repository hooks or ran an affected CI workflow should treat the environment as potentially compromised.

After isolating the system and removing the implant and token monitor, revoke and replace every credential that was accessible from that host. Also audit npm for unexpected package releases and GitHub for unfamiliar repositories or commits created by the compromised account.

Sources

Socket Security’s technical report:

https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain

Socket’s continuously updated affected-package tracker:

https://socket.dev/supply-chain-attacks/keyv-and-cacheable-compromise