Keyv-Linked npm Worm Poisons Hundreds of Packages
Credential-stealing npm worm spreads across developer environments.
1Widespread npm Security Breach
An npm worm that transcended the Keyv and Cacheable namespaces affected hundreds of packages on August 4, 2026. SafeDep identified 353 poisoned versions under 79 package names in the npm registry. Aikido reported at least 868 packages across 1,381 versions were compromised. The attack used preinstall scripts to steal credentials in developer and continuous integration environments.
2Credential Theft Mechanism
The malware harvests repository, package registry, cloud, and private key materials. It then uses available npm publishing access to poison more packages. The Keyv repository also contains Claude Code and VS Code hooks that can execute the payload once a user trusts the workspace or permits the project configuration.
3Scope of Affected Systems
Socket advises that any workstation or runner executing an affected version should be treated as credential-exposed. SafeDep recommends responders remove the malware's credential revocation watcher before rotating exposed tokens and keys. Revocation triggers the watcher; rotating first can execute an attacker-supplied local handler.
4Spread of Poisoned Packages
The first confirmed malicious release was [email protected]. It added node setup.mjs as a preinstall command and included setup.mjs and Math_Symbol.js in the package while leaving compiled library code unchanged. Stage one checks for Bun, downloads version 1.3.13 from the runtime's official GitHub releases if needed, and hands off to a 727,680-byte compiled bundle.
5Data Collected by the Payload
SafeDep's payload analysis shows the bundle collects GitHub, npm, cloud, Vault, Kubernetes, database, and private key materials. It also reads GitHub Actions runner memory, installs a token revocation watcher, and carries npm publishing machinery. Socket separately decoded code for modifying, versioning, and republishing packages available to a stolen npm identity.
6Rapid Changes in the Registry
The registry changed too quickly to support a fixed campaign-wide package list. At 5:40 p.m. IST on August 4, npm package pages showed earlier releases restored as latest for at least nine packages from SafeDep's initial set, including [email protected], [email protected], and [email protected].
7Secondary Execution Path
The repository carries a second execution path. Its .claude/settings.json contains a SessionStart hook calling .vscode/setup.mjs. The .vscode/tasks.json file contains an Environment Setup task with runOn: folderOpen calling .claude/setup.mjs. These files create a route for executing the payload from a checked-out repository but don't run unconditionally in every default environment.
8Security Measures and Risks
VS Code blocks automatic tasks in an untrusted workspace and prompts before allowing them by default. Claude Code applies workspace trust to repository-supplied project settings. At 5:40 p.m. IST on August 4, both hook files remained present on main. The core/keyv/package.json manifest still declared version 6.0.0, retained node setup.mjs as its preinstall command, and listed setup.mjs and Math_Symbol.js for publication.
Original article: The Hacker News — Keyv-Linked npm Solucanı Yüzlerce Paketi Zehirledi