# Keyv-Linked npm Worm Poisons Hundreds of Packages Credential-stealing npm worm spreads across developer environments. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-08-04 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/b1302e1c-6577-4f10-a74a-24fe71002183 ## Widespread npm Security Breach An npm worm that transcended the Keyv and Cacheable namespaces affected hundreds of packages on August 4, 2026. SafeDep identified 353 poisoned versions under 79 package names in the npm registry. Aikido reported at least 868 packages across 1,381 versions were compromised. The attack used preinstall scripts to steal credentials in developer and continuous integration environments. ## Credential Theft Mechanism The malware harvests repository, package registry, cloud, and private key materials. It then uses available npm publishing access to poison more packages. The Keyv repository also contains Claude Code and VS Code hooks that can execute the payload once a user trusts the workspace or permits the project configuration. ## Scope of Affected Systems Socket advises that any workstation or runner executing an affected version should be treated as credential-exposed. SafeDep recommends responders remove the malware's credential revocation watcher before rotating exposed tokens and keys. Revocation triggers the watcher; rotating first can execute an attacker-supplied local handler. ## Spread of Poisoned Packages The first confirmed malicious release was keyv@6.0.0. It added node setup.mjs as a preinstall command and included setup.mjs and Math_Symbol.js in the package while leaving compiled library code unchanged. Stage one checks for Bun, downloads version 1.3.13 from the runtime's official GitHub releases if needed, and hands off to a 727,680-byte compiled bundle. ## Data Collected by the Payload SafeDep's payload analysis shows the bundle collects GitHub, npm, cloud, Vault, Kubernetes, database, and private key materials. It also reads GitHub Actions runner memory, installs a token revocation watcher, and carries npm publishing machinery. Socket separately decoded code for modifying, versioning, and republishing packages available to a stolen npm identity. ## Rapid Changes in the Registry The registry changed too quickly to support a fixed campaign-wide package list. At 5:40 p.m. IST on August 4, npm package pages showed earlier releases restored as latest for at least nine packages from SafeDep's initial set, including keyv@5.6.0, flat-cache@6.1.23, and cache-manager@7.2.9. ## Secondary Execution Path The repository carries a second execution path. Its .claude/settings.json contains a SessionStart hook calling .vscode/setup.mjs. The .vscode/tasks.json file contains an Environment Setup task with runOn: folderOpen calling .claude/setup.mjs. These files create a route for executing the payload from a checked-out repository but don't run unconditionally in every default environment. ## Security Measures and Risks VS Code blocks automatic tasks in an untrusted workspace and prompts before allowing them by default. Claude Code applies workspace trust to repository-supplied project settings. At 5:40 p.m. IST on August 4, both hook files remained present on main. The core/keyv/package.json manifest still declared version 6.0.0, retained node setup.mjs as its preinstall command, and listed setup.mjs and Math_Symbol.js for publication. ## Sources covering this story - https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._