Poisoned Pipeline

Poisoned Pipeline / Incidents / AS28

AS28 · 2026-08

Keyv / Cacheable ChainDrop worm

npmGitHub ActionsDeveloper workstationAI coding agentsKubernetes

Maintainer Jared Wray's postmortem of the ChainDrop/Shai-Hulud wave on
keyv and cacheable. A leftover full-access GitHub PAT on an infected
developer machine pushed poisoned commits; the projects' own GitHub
Actions plus npm OIDC trusted publishing released them. Poisoned packages
therefore carried genuine SLSA/valid provenance. Provenance proved which
commit was built, not that the commit was authorized. First-wave payload
was a preinstall hook dropping a Bun second stage that harvested
npm/GitHub/AWS/Kubernetes/Vault credentials. About 444 package names /
2,212 versions in roughly four hours.

Mapped techniques

supply-chain Maintainer machine and release workflow

T0153 · Initial Access · Compromised developer workstation

Infected laptop held a stale full-access GitHub PAT.

T0112 · Initial Access · Compromised token

The leftover PAT pushed poisoned commits to keyv/cacheable.

T0166 · Execution · Trigger pipeline execution

The project's own release workflow published the poison.

T0202 · Persistence · Inadequate CI/CD workflow permissions

OIDC trusted publishing with write-capable automation.

T0206 · Defense Evasion · Forge or omit build provenance

Provenance was real and valid — and still described a malicious
commit. Presence of SLSA did not mean the commit was authorized.

T0109 · Resource Development · Publish malicious artifact

Hundreds of package names published in hours.

T0151 · Execution · Installation scripts

preinstall downloaded a Bun second-stage harvester.

T0140 · Credential Access · Harvest tokens from environment variables

npm, GitHub, AWS, Kubernetes, and Vault creds.

Sources