Worm Propagates Through Over 2,000 npm Package Versions, Compromising Supply‑Chain Integrity
What Happened
A malicious worm was introduced into the public npm registry by compromising the release credentials of the widely‑used keyv and cacheable packages. The attacker added a pre‑install hook that downloads a Bun runtime, harvests cloud and CI/CD credentials (HashiCorp Vault, Kubernetes, GitHub Actions, npm tokens, instance metadata), encrypts them, and republishes trojanized versions of more than 2,000 package releases across 444 distinct libraries. The infected packages are downloaded >500 million times per week, giving the worm a large attack surface.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous monitoring of third‑party software integrity and automated SBOM validation—core controls in a SOC 2 Security (CC6.1) program.
- Highlights the importance of credential‑rotation policies and least‑privilege access for CI/CD pipelines, aligning with SOC 2 Security (CC6.2) and Privacy (CC1.2) criteria.
- Shows why incident‑response documentation must include supply‑chain breach scenarios, ensuring audit evidence for the “Risk Management” principle.
Who Is Affected
- Software development firms that ship Node.js applications.
- Enterprises that rely on npm packages for production workloads (e.g., fintech, SaaS, e‑commerce).
- Cloud service providers and customers using automated CI/CD pipelines.
- Open‑source maintainers and downstream package consumers.
Recommended Actions
- Audit your dependency tree for any of the listed keyv, cacheable, cacheable‑request, flat‑cache, and file‑entry‑cache versions.
- Generate or update a Software Bill of Materials (SBOM) and run automated scanning against known malicious signatures.
- Rotate all potentially exposed credentials (Vault tokens, GitHub Actions tokens, npm tokens, cloud metadata).
- Enforce signed package publishing and restrict who can publish to your internal registries.
- Incorporate supply‑chain breach scenarios into your incident‑response playbook and test the workflow.
Technical Notes
- Attack vector: Malicious pre‑install hook (
setup.mjs) in compromised npm packages; self‑replicating via stolen npm tokens. - CVEs: None disclosed in the report.
- Data types exposed: Cloud service credentials, CI/CD tokens, private key blocks, bearer tokens.
Source: DataBreachToday – Worm Targets More Than 2,000 npm Package Versions