Keyv-Linked NPM Worm Infects Hundreds of JavaScript Packages in Supply Chain Attack
On August 4, 2026, a sophisticated credential-stealing worm infected the npm ecosystem, beginning with keyv version 6.0.0 and rapidly spreading to hundreds of packages across multiple organizations. The attack affected somewhere between 79 and 868 packages depending on the source, with SafeDep later confirming 1,684 poisoned versions across 420 package names tied to nine organizations. The malware used a preinstall script to execute a credential-theft payload on developer machines and continuous integration environments, capable of stealing repository credentials, npm tokens, cloud access keys, private keys, and other sensitive data. Once it gained access to npm publishing credentials, the worm automatically propagated itself by infecting additional packages at a rate that allowed it to jump between organizations every two to seven minutes.
The technical implementation was layered and persistent. The primary infection vector was a preinstall lifecycle script that downloaded the Bun runtime if needed and executed a large compiled bundle containing the malicious code. This bundle not only stole credentials from various sources including GitHub, npm registries, cloud providers, Vault, Kubernetes, and databases, but also installed a credential-revocation watcher that could detect when compromised tokens were being rotated. The Keyv repository also included secondary execution paths through Claude Code and Visual Studio Code workspace hooks that could trigger the payload if a developer trusted the workspace or allowed the project configuration to run.
The attack demonstrated several concerning characteristics that complicated response efforts. The poisoned packages carried valid OpenID Connect and SLSA provenance attestations because they were published through legitimate GitHub Actions workflows, showing that cryptographic signatures can confirm the build process but cannot verify whether the source code itself is safe. The registry responded by unpublishing some malicious versions and restoring earlier clean releases as latest, but many affected packages still resolved to compromised versions at the time of reporting. This means that simply upgrading dependencies could still pull in infected code, making version-specific checks against lockfiles essential for determining exposure.
Security researchers linked the attack to the Shai-Hulud malware family based on technical overlaps with an April 2026 compromise of the lightning PyPI package, including identical Claude Code and Visual Studio Code hook implementations and the same Bun runtime version download. However, the initial access method and the actor behind the campaign remain unknown. SafeDep identified 546 public GitHub repositories created on August 4 with descriptions referencing the attack, though these represent potential staging or exfiltration artifacts rather than confirmed victim counts. Responders must treat any system that executed an affected package version as fully compromised, remove the credential-revocation watcher before rotating secrets, and verify resolved versions against the growing list of poisoned releases rather than relying on namespace-level blocklists or current registry tags.
Stay secure — stay Wavasec. 🔐
