The GitHub account of maintainer jaredwray was compromised on August 4, 2026, leading to the publication of keyv@6.0.0 and ten other npm packages containing malware with valid OIDC provenance attestations and SLSA signatures. The technique exposes a structural paradox: cryptographic signatures faithfully attest to a build whose source or workflow context has already been tampered with.
Attackers exploited an execution vector that remains largely unmonitored: configuration files for AI agents integrated into development environments such as VS Code and Claude Code. These files are not analyzed by dependency scanners, allowing malicious code execution the moment a developer opens a project folder.
- Eleven npm packages, including keyv@6.0.0 and cacheable@2.5.1, were published with identical payloads via a preinstall hook on August 4, 2026.
- .claude/settings.json and .vscode/tasks.json files in the repository trigger automatic execution on folder open, invisible to traditional tooling.
- SLSA attestations and OIDC provenance were valid: the GitHub Actions workflow signed artifacts built from compromised source.
- The C2 infrastructure uses an upgradable Ethereum smart contract with a token revocation watcher that reacts to credential rotation.
Maintainer Compromise and Signed Publication
At 5:00 AM ET on August 4, 2026, malicious files were pushed to the keyv repository's main branch. Four minutes later, a commit bearing a verified badge added persistence hooks for Claude Code and VS Code, authored by claude@users.noreply.github.com with the message "chore: update config." At 5:35 AM ET, keyv@6.0.0 was published to npm.
Snyk statically analyzed the tarballs, confirming that all contained setup.mjs (29,918 bytes) and Math_Symbol.js (727,680 bytes) with identical hashes. As of 11:16 UTC, eight malicious releases were still tagged latest on npm; three had already been removed (flat-cache, cacheable-request, cache-manager).
The execution mechanism is declared explicitly in package.json: "preinstall": "node setup.mjs". npm runs this hook automatically during installation, requiring no user interaction or module import in the application.
The AI Agent Config Blind Spot: Code That Runs Without Package Installation
The compromised repository contained .claude/settings.json with a SessionStart hook pointing to a loader script, and .vscode/tasks.json with an "Environment Setup" task configured with "runOn": "folderOpen". Kodem Security highlighted the problem: "Agent configuration files execute code, they live in repositories, and no dependency scanner reads them."
The same source emphasized the scope of the pattern: "The structural significance of the technique goes beyond any individual attack." Unlike the npm payload, which requires at least an installation, these files trigger execution the moment a developer opens the project in an IDE or AI agent.
The worm actively propagated these configuration files, committing them to as many as 50 branches per victim repository. This self-propagation mechanism amplifies the attack surface beyond the malicious package installation alone.
Provenance and SLSA: When the Signature Becomes the Attacker's Weapon
A distinctive element of this attack is the presence of valid provenance attestations. The npm manifest identifies GitHub Actions as the trusted publisher, with a workflow that built artifacts from already-compromised source. Snyk Security Research articulated the principle clearly: "Provenance can faithfully attest a build whose source or workflow context has already been compromised."
The verified commit represents another point of fragility. The GitHub verified badge on commit d8c850c7 comes from a GitHub signature but does not establish that the change was authorized by the maintainer. As Snyk notes: "A verified badge proves that GitHub signed the commit object. It does not establish that the change was authorized by the project maintainer."
This creates an interpretation problem for security tools and developers alike: the presence of signatures and badges does not equate to validation of content or authorization.
Decentralized C2 and Persistence via Token Watcher
The command-and-control infrastructure relies on an Ethereum StringListStore smart contract at address 0xE1f2395ee43e45A1556EC6438a88c31B83493103. Wiz Research identified eth_call queries to this contract, initially configured with three domains and later updated to npm-cache[.]com. The structure is infrastructure-agnostic: attackers can modify C2 domains without touching the on-disk payload.
A particularly insidious persistence mechanism is the token revocation watcher (gh-token-monitor). Snyk confirmed that this component observes when a stolen GitHub token is revoked and executes an attacker-controlled handler. Credential rotation, normally considered a countermeasure, becomes a trigger for additional malicious actions in this case.
Aikido Security counted over 434 compromised packages with more than two billion combined monthly downloads.
Immediate Actions
Developers and organizations that installed any package from the keyv family on August 4, 2026, or cloned the repository must consider the environment compromised. Priority actions derive directly from source analysis.
Audit lockfiles to identify suspicious versions published during the attack window, paying attention to the 11 malicious releases documented by Snyk. Isolate hosts that performed installations during the critical period and rotate credentials from verified clean systems.
Explicitly monitor agent configuration files not covered by traditional scanners, including .claude/settings.json and .vscode/tasks.json, in both internal repositories and extracted dependencies. Verify the presence of SessionStart hooks and tasks with runOn folderOpen.
Review trust criteria for SLSA attestations and verified badges: these mechanisms attest to build origin, not the integrity of upstream source or the authorization of the change.
An Attack Model That Redefines the Boundaries of the Possible
The keyv incident is not an isolated case but an operational demonstration of techniques that had been theorized. The combination of signed provenance, AI agent files invisible to scanners, and C2 based on an Ethereum smart contract constitutes a reproducible model. Persistence via token revocation watcher inverts incident response logic: a standard countermeasure becomes a vector for further compromise.
The scale of reach is significant: keyv records approximately 127 million weekly downloads; flat-cache and file-entry-cache each see roughly 565–580 million monthly downloads. Aikido observed approximately 1,300 public GitHub repositories created on August 4 for exfiltration. Wiz Research reports a 70% expansion in credential targeting compared to previous waves.
The most concerning datum remains the vector's structure: as long as security tools do not read AI agent configuration files with the same scrutiny applied to dependencies, every project opened in an IDE is a potential execution opportunity. Signed provenance, intended as a guarantee, can instead become a false inference of security.
Frequently Asked Questions
Why didn't SLSA provenance block the attack?
SLSA attestations verify that the build originated from a trusted workflow and that the artifact was not modified after signing. They do not verify that the source on which the workflow ran was uncompromised. In this case, GitHub Actions correctly signed an artifact built from malicious code.
Are AI agent files a threat even without npm installation?
Yes. The .claude/settings.json and .vscode/tasks.json files in the repository trigger execution on folder open, independent of package installation. This makes them an autonomous vector, undetected by dependency scanners.
What is the remediation status?
At the time of Snyk's research, no clean successor versions were available for keyv@6.0.0. Three packages had been removed from npm by 11:16 UTC on August 4. Maintainer jaredwray has not provided public updates on the status of their account.
Sources
- https://www.techtimes.com/articles/323089/20260805/keyv-npm-supply-chain-attack-hides-malware-ai-agent-files-scanners-never-read.htm
- https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/
- https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/
- https://security.snyk.io/vuln/SNYK-JS-KEYV-18515941
- https://security.snyk.io/package/npm/cacheable
Information verified against cited sources and current as of publication.