Review and remove temporary Keyv/Cacheable dependency overrides by 31 August 2026

[TheRealAgentK]

Review date

Review no later than 31 August 2026.

The repository temporarily pins the following development-only transitive dependencies in the root package.json as defense in depth during the active Keyv/Cacheable npm supply-chain incident:

"overrides": {
  "keyv": "4.5.4",
  "flat-cache": "4.0.1",
  "file-entry-cache": "8.0.0"
}

These were the already-resolved clean versions when the protection was introduced. The known malicious releases were in newer major-version lines, so this is temporary containment rather than remediation of an identified exposure. Root overrides protect this repository's installs; they do not impose dependency resolutions on consumers of the published @raygun.io/aws-lambda package.

Incident notification and evolving affected-package list: https://socket.dev/supply-chain-attacks/keyv-and-cacheable-compromise

Removal review checklist

Before removing the overrides:

• Read the latest incident status and affected artifact list at the Socket link above, plus any authoritative npm or maintainer remediation notice.
• Confirm keyv@4.5.4, flat-cache@4.0.1, and file-entry-cache@8.0.0 have not been identified as compromised.
• Compare every package/version in the current package-lock.json with the latest affected-package list; do not limit the scan to these three names.
• Run npm ls keyv flat-cache file-entry-cache --all and inspect which parents and version ranges now require them.
• Verify the unoverridden dependency graph resolves only to versions that are both clean and compatible with their parent constraints.
• Check the repository and installed tree for campaign indicators such as setup.mjs, Math_Symbol.js, math_init.js, malicious lifecycle hooks, and unexpected .claude/settings.json or .vscode/tasks.json hooks.
• Confirm CI and release installs still use npm ci with the committed lockfile.

Unroll procedure

1. Remove the three entries and the overrides object from package.json.
2. Run npm install --package-lock-only --ignore-scripts to regenerate dependency metadata without executing lifecycle scripts.
3. Review the complete package.json and package-lock.json diff. Investigate any version, source URL, integrity hash, or lifecycle-script change.
4. Run a clean npm ci.
5. Re-run the affected-package scan and npm ls keyv flat-cache file-entry-cache --all.
6. Run npm test, npm run eslint, npm run tseslint, and npm run prettier:check.
7. Remove the overrides in a reviewed pull request and link that PR here.

If the incident is not contained or the clean status is uncertain at the end-of-August review, keep the overrides, document the evidence and reason here, and set a new explicit target date. Do not close this issue merely because the review date arrived.