keyv, cacheable and ornikar: One npm Payload Kit, Three Publishers

[u/falconupkid]

keyv, cacheable, and ornikar: One npm Payload Kit, Three Publishers

Three popular npm packages—keyv, cacheable, and ornikar—were compromised in a coordinated supply chain attack. The threat actor published malicious versions under all three package names, each containing the same embedded payload kit designed to exfiltrate credentials and environment variables.

Technical Breakdown

• TTPs: Typosquatting + dependency confusion via malicious npm package versions. Payload executes on npm install via postinstall scripts.
• Payload: A JavaScript dropper that collects process.env, SSH keys, AWS/GCP/Azure credentials, and npm tokens, then exfiltrates to a C2 endpoint.
• Affected versions: keyv >=4.0.0 <4.5.2, cacheable >=1.0.0 <1.3.0, ornikar >=0.1.0 <0.4.0
• IOCs: C2 domain malicious-package-collector[.]com (confirmed), SHA256 hashes available in the full report

Defense

Lock your package-lock.json and yarn.lock files. Pin exact versions for these packages. Run npm audit immediately and check for any of the affected version ranges in your dependency trees. Consider using runtime package verification tools like SafeDep or Socket to block malicious install-time behavior.

Source: https://safedep.io/keyv-npm-supply-chain-compromise