🔴 Critical | Source: The Hacker News
A malicious npm worm, originating in keyv@6.0.0, self-propagated across the npm registry on 4 August 2026, poisoning hundreds of packages with credential-stealing code and injecting hooks into Claude Code and VS Code. Independent researchers confirmed between 353 and 868 affected packages across dozens of organisations. The self-replicating nature of the attack makes this one of the most significant npm supply chain incidents to date.
Security Architect’s Take: Audit your dependency trees immediately for any packages depending on keyv or cacheable and pin known-good versions; run npm audit and cross-reference against the SafeDep and Aikido IOC lists. Treat any CI/CD pipeline or developer machine that installed affected packages since 4 August 2026 as potentially compromised and rotate all secrets accessible from those environments.
Original advisory: Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks