Credential‑Stealing npm Worm Targets Hundreds of Packages in Keyv Namespace
A credential‑stealing worm first seen in keyv@6.0.0 has infected hundreds of npm packages, prompting maintainers to audit dependencies and adopt stricter security tools.
A credential‑stealing worm first surfaced in the keyv@6.0.0 package and quickly spread across the npm ecosystem, infecting hundreds of packages and compromising the integrity of dozens of organizations.
The worm’s initial appearance in keyv@6.0.0 was flagged on August 4, 2026, when maintainers noticed anomalous code injections that were not present in the original source.
Unlike earlier npm incidents that were limited to a single namespace, this worm crossed the boundaries of Keyv and the Cacheable namespace, infiltrating a wide array of unrelated packages.
SafeDep’s automated scans identified 353 poisoned versions spanning 79 distinct package names, illustrating the breadth of the attack.
The project’s continuous monitoring extended the footprint to 442 versions across 353 package names, underscoring the worm’s persistence.
Aikido’s later analysis reported that at least 868 packages were affected, a figure that further highlights the scale of the compromise.
The malicious payload injects “Claude” code and Visual Studio Code hooks, enabling attackers to harvest credentials and gain elevated control over development environments.
The worm’s design allows it to propagate via dependency trees, meaning that a single compromised package can spread malicious code to all of its dependents.
In response, maintainers are urged to audit lockfiles, pin exact versions, and run integrity checks with tools such as SafeDep or npm audit.
Continued vigilance and prompt patching remain essential, as the npm community confronts a new era of sophisticated supply‑chain attacks.
Credential‑Stealing npm Worm Targets Hundreds of Packages in Keyv Namespace
A credential‑stealing worm first surfaced in the keyv@6.0.0 package and…
A credential‑stealing worm first surfaced in the keyv@6.0.0 package and quickly spread across the npm ecosystem, infecting hundreds of packages and compromising the integrity of dozens of organizations.
The worm’s initial appearance in keyv@6.0.0 was flagged on August 4, 2026, when maintainers noticed anomalous code injections that were not present in the original source.
Unlike earlier npm incidents that were limited to a single namespace, th…
Unlike earlier npm incidents that were limited to a single namespace, this worm crossed the boundaries of Keyv and the Cacheable namespace, infiltrating a wide array of unrelated packages.
SafeDep’s automated scans identified 353 poisoned versions spanning 79 distinct package names, illustrating the breadth of the attack.
The project’s continuous monitoring extended the footprint to 442 versio…
The project’s continuous monitoring extended the footprint to 442 versions across 353 package names, underscoring the worm’s persistence.
Aikido’s later analysis reported that at least 868 packages were affected, a figure that further highlights the scale of the compromise.
The malicious payload injects “Claude” code and Visual Studio Code hooks…
The malicious payload injects “Claude” code and Visual Studio Code hooks, enabling attackers to harvest credentials and gain elevated control over development environments.
The worm’s design allows it to propagate via dependency trees, meaning that a single compromised package can spread malicious code to all of its dependents.
In response, maintainers are urged to audit lockfiles, pin exact version…
In response, maintainers are urged to audit lockfiles, pin exact versions, and run integrity checks with tools such as SafeDep or npm audit.
Continued vigilance and prompt patching remain essential, as the npm community confronts a new era of sophisticated supply‑chain attacks.