On August 4, 2026, a threat actor compromised the source or release credentials for the widely used keyv and cacheable npm packages and published trojanized versions of at least ten packages, beginning with keyv@6.0.0 at 09:35 UTC. Unlike a typical dependency swap, each version carries a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime and executes an obfuscated ~728 KB second stage (Math_Symbol.js). The payload harvests cloud, CI, and registry credentials (AWS instance metadata, Vault, Kubernetes, GitHub Actions, and npm tokens), encrypts them with AES-256-GCM under an operator public key, and delivers them to threat actor GitHub repositories and DNS-resolved destinations. It then self-propagates as a worm, republishing trojanized versions of other packages the stolen npm token can reach and minting fresh sigstore provenance for them. Critically, keyv@6.0.0 shipped with passing npm provenance (a signed SLSA attestation) because the legitimate release workflow built already-trojanized source, so signature verification passed on malware. Socket flagged keyv@6.0.0 within six minutes of publication; the campaign then spread to packages under other maintainers, including @thiennq/docs-viewer and three @qlik packages. The tradecraft matches the Shai-Hulud npm worm activity.