Aug 7, 2026 · 25 min · 8 segments
This week we talked about: - **New npm worm hits Keyv and cacheable.** Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced…
Jenn GileHost
Paul McCartyHost
Uh, we kinda figured after the success that Team PCP had during, I don't know, Hacker Spring Break, whatever you wanna call the set of things in San Francisco [laughs] back in March, um, that we figured an attacker would try to pull the same thing this week.
Um, there's some scuttlebutt that the attackers didn't quite, uh, do things in the, the most complete and high-quality way.
Um, we've been in communication with the person who, as far as we can tell, was the, the patient zero, um, Jared Rea, who maintains, I don't know if it's keyvee or cave.
I don't know how you pronounce it, and, uh, cacheable, but he mains a ca- maintains a couple projects.
He was locked out for at least it seems like maybe 12 hours, while threat actors published the worm and then, uh, it made it into, you know, other parts of the ecosystem.
Well, I think the first thing that's notable is that while you're right that the threat actor in this case, we don't believe that this is a, a highly competent threat actor to...
Um, but that said, my, my point I'm driving at here is that even though this is not a highly competent threat actor, at the same time, this was still a very, unfortunately, a very successful attack in the sense that it, it infected a lot of packages, had a lot of reach.
Um, so it just goes to show you that, that even if somebody fumbles the hand grenade, it's still pretty freaking dangerous.
Uh, I don't know if that's all of their packages, but that's certainly a lot of packages, and that seems to be the biggest, um, single impact that we're seeing with this attack.
And we also heard some inside baseball that this might be related to a long-lived legacy cat.
We haven't, we haven't found that yet, but if that's the case, just goes to show you...
Uh, we kinda figured after the success that Team PCP had during, I don't know, Hacker Spring Break, whatever you wanna call the set of things in San Francisco [laughs] back in March, um, that we figured an attacker would try to pull the same thing this week.
Um, there's some scuttlebutt that the attackers didn't quite, uh, do things in the, the most complete and high-quality way.
Um, we've been in communication with the person who, as far as we can tell, was the, the patient zero, um, Jared Rea, who maintains, I don't know if it's keyvee or cave.
I don't know how you pronounce it, and, uh, cacheable, but he mains a ca- maintains a couple projects.
He was locked out for at least it seems like maybe 12 hours, while threat actors published the worm and then, uh, it made it into, you know, other parts of the ecosystem.
Well, I think the first thing that's notable is that while you're right that the threat actor in this case, we don't believe that this is a, a highly competent threat actor to...
Um, but that said, my, my point I'm driving at here is that even though this is not a highly competent threat actor, at the same time, this was still a very, unfortunately, a very successful attack in the sense that it, it infected a lot of packages, had a lot of reach.
Um, so it just goes to show you that, that even if somebody fumbles the hand grenade, it's still pretty freaking dangerous.
Uh, I don't know if that's all of their packages, but that's certainly a lot of packages, and that seems to be the biggest, um, single impact that we're seeing with this attack.
And we also heard some inside baseball that this might be related to a long-lived legacy cat.
We haven't, we haven't found that yet, but if that's the case, just goes to show you...
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
