malware
npm
cacheable-request
discovered 2026-08-04Cacheable HTTP request library (33M weekly downloads). Unpublished from npm, still on npmmirror. Compromised via jaredwray account. Variant A payload.
Threat types
credential_stealer worm persistence
Malicious versions
- 13.0.20
