Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

Socket's Threat Research Team documents an ongoing, active npm supply-chain compromise that injected a malicious `preinstall` hook into `keyv` and related `cacheable` packages; the hook downloads a Bun runtime to execute an obfuscated second-stage payload (`Math_Symbol.js`) that exfiltrates cloud and CI credentials, repackages and republishes trojanized packages via stolen npm tokens, and establishes persistence (including a dead-man's switch and autostart hooks targeting cloned repos). The report includes a detailed timeline, technical analysis, IOCs (file and tarball hashes, network endpoints), impact assessment, attribution commentary, and remediation guidance for developers and security teams.