malware
npm
keyv
discovered 2026-08-04Popular key-value storage library (154M weekly downloads). Compromised via jaredwray account takeover. Variant A payload: setup.mjs (29,918 bytes) + Math_Symbol.js stage-two.
Threat types
credential_stealer worm persistence
Malicious versions
- 6.0.0 · 54dc7ea54a1317cc…
Campaigns
Indicators
- sha256 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668indicates
- sha256 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bccindicates
- wallet 0xE1f2395ee43e45A1556EC6438a88c31B83493103communicates-with
- domain npm-cache.comexfiltrates-to
- domain js-mirror.comexfiltrates-to
- domain pypi-get.comexfiltrates-to
Techniques
- ttp T1195.001 Compromise Software Dependencies and Development Toolsuses
- ttp T1059.007 Command and Scripting Interpreter: JavaScriptuses
- ttp T1552.001 Unsecured Credentials: Credentials In Filesuses
- ttp T1546 Event Triggered Executionuses
- ttp T1027 Obfuscated Files or Informationuses
- ttp T1105 Ingress Tool Transferuses
- ttp Verified Commit Spoofinguses
- ttp EtherHiding: Blockchain-Based C2 Bootstrappinguses
- ttp T1003.007 OS Credential Dumping: Proc Filesystemuses
