🚨 npm 공급망 공격 발생: 개발자 자격 증명을 탈취하고 Claude Code 및 VS Code 환경을 노리는 웜 🚨

It spreads like a worm

This is not limited to the original compromised packages.

After stealing an npm token, the malware discovers other packages the victim is authorized to publish. It downloads those packages, injects the same malicious hook and payload, increases the version number and republishes the infected versions using the victim’s own npm identity.

That is how the attack spread from the original keyv and cacheable maintainer into packages owned by other people and organizations.

It also targets AI coding agents and IDEs

The attackers planted additional execution hooks in the source repositories:

• .claude/settings.json containing a Claude Code SessionStart hook
• .vscode/tasks.json containing a VS Code folderOpen task
• math_init.js, containing the same malicious payload

These hooks can execute when a cloned repository is opened through an AI coding agent or trusted development environment, depending on the tool’s trust and approval settings.

That means an attacker may not need the developer to run npm install. Opening or trusting the repository in Claude Code or VS Code can provide a separate execution path.

To avoid confusion: this does not mean that reading this post, visiting the article or using an ordinary ChatGPT conversation infects your computer. The risk applies to developer machines, CI runners and AI coding environments that clone, open, trust or install compromised code.

Signed provenance did not guarantee safety

keyv@6.0.0 reportedly shipped with valid npm/Sigstore provenance because the legitimate release workflow built source code that had already been compromised.

The signature correctly proved which build system produced the package. It did not prove that the source code supplied to that build system was safe.

Important warning before rotating credentials

The malware installs a persistence mechanism described as a dead-man’s switch on macOS and Linux.

It creates a gh-token-monitor service that checks whether a stolen GitHub token is still valid. When the token is revoked or rotated and begins returning an HTTP 4xx response, the monitor executes an attacker-supplied command.

Potential indicators include:

text ~/.local/bin/gh-token-monitor.sh ~/.config/gh-token-monitor/ ~/Library/LaunchAgents/com.user.gh-token-monitor.plist ~/.config/systemd/user/gh-token-monitor.service /tmp/gh-token-monitor.out.log /tmp/gh-token-monitor.err.log

Other files and activity to investigate include:

text setup.mjs Math_Symbol.js math_init.js bun-dl-* .claude/settings.json .vscode/tasks.json

Do not blindly begin rotating credentials from a machine that may be infected. Isolate the system and remove the monitor and malicious payload first. Credential rotation should then be performed from a separate, known-clean device.

Recommended precautions

• Avoid updating or installing affected packages until the situation is resolved.
• Pin dependencies to exact known-safe versions rather than using caret or tilde ranges.
• Rebuild and review lockfiles.
• Check Socket’s live campaign tracker instead of relying on a static package list.
• Temporarily install dependencies using:

bash npm ci --ignore-scripts

or:

bash npm install --ignore-scripts

The --ignore-scripts option prevents npm lifecycle hooks such as preinstall and postinstall from running automatically. It may also prevent legitimate packages from completing necessary setup steps.

It does not protect against the separate .claude or .vscode repository hooks.

Before opening an unfamiliar repository locally, inspect:

text .claude/settings.json .vscode/tasks.json package.json

Do not automatically trust unknown workspaces or approve unexpected startup hooks.

Anyone who installed an affected release with lifecycle scripts enabled, executed the repository hooks or ran an affected CI workflow should treat the environment as potentially compromised.

After isolating the system and removing the implant and token monitor, revoke and replace every credential that was accessible from that host. Also audit npm for unexpected package releases and GitHub for unfamiliar repositories or commits created by the compromised account.

Sources

Socket Security’s technical report:

https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain

Socket’s continuously updated affected-package tracker:

https://socket.dev/supply-chain-attacks/keyv-and-cacheable-compromise