Cacheable
AssessTools
A Node.js caching-related project mentioned as part of the affected package ecosystem.
Why it's here
Placed in Assess: 1 article(s) of evidence from 1 source(s), led by security coverage, with 1 in the last 30 days. Confidence 24%. Low accumulated evidence, so it defaults conservatively pending more signal.
Evidence (1)
- 9The New Stack·8/7/2026securitynpm supply-chain attack hides malware behind provenance attestations
Security researchers disclosed an npm supply-chain attack that compromised more than 400 packages, including projects tied to Keyv and Cacheable. The attackers used stolen maintainer credentials and lifecycle hooks to spread malware, showing that provenance attestations do not guarantee package integrity once a trusted workflow is compromised.