Keyv-linked npm worm spreads through packages and developer hooks
A credential-stealing npm worm first confirmed in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces on August 4, 2026. SafeDep verified 353 poisoned versions across 79 npm package names, while its monitoring indicated 442 versions across 353 names. Aikido later reported at least 868 packages across 1,381 versions, although neither broader total could be independently reproduced from a complete public list by the reporting cutoff.
The malicious Keyv release added node setup.mjs as a preinstall command and shipped setup.mjs and Math_Symbol.js without changing the compiled library code. The first stage checks for Bun and downloads version 1.3.13 from its official GitHub releases when necessary, then starts a 727,680-byte compiled bundle.
Credentials and publishing access at risk
SafeDep found code for harvesting GitHub, npm, cloud, Vault, Kubernetes, database and private-key material, as well as reading GitHub Actions runner memory. The payload also installs a token-revocation watcher and carries npm publishing machinery. Socket separately decoded functions for modifying, versioning and republishing packages accessible to a stolen npm identity.
The campaign illustrates borrowed trust as a central cybersecurity tactic because valid workflows, signatures and familiar tooling can still carry unsafe source into trusted channels. The poisoned Keyv release had valid OpenID Connect and SLSA provenance after passing through the legitimate GitHub Actions release workflow. That attestation identified how the artifact was built, but did not establish that its source was safe.
The hook-planting commit also showed a green GitHub-verified badge and named github-actions[bot] as its author. These details establish a valid signature and the recorded author field; they do not identify who controlled the credential used to submit the commit.
Repository hooks create another execution route
The repository retained a Claude Code SessionStart hook in .claude/settings.json that calls .vscode/setup.mjs. A VS Code task in .vscode/tasks.json used runOn: folderOpen to call .claude/setup.mjs. Both files were still present on the main branch at 5:40 p.m. IST on August 4.
These hooks do not execute unconditionally in every default environment. VS Code blocks automatic tasks in an untrusted workspace and prompts before permitting them by default, while Claude Code applies workspace trust to project-supplied settings.
Response depends on exact resolved versions
Registry tags changed rapidly. Earlier clean releases had been restored as latest for at least nine packages from SafeDep's initial set by 5:40 p.m. IST, including keyv@5.6.0, flat-cache@6.1.23 and cache-manager@7.2.9. SafeDep also said the published @keyv/* adapters and the Keyv 5.x line were clean.
Campaign totals count malicious artifacts, not infected systems. Exposure therefore depends on the exact package version resolved on a machine and whether its lifecycle script executed. npm 12 blocks unapproved dependency lifecycle scripts by default, but earlier clients and other installation paths that allow such scripts remain exposed.
Socket advises treating every workstation or CI runner that executed an affected version as credential-exposed. SafeDep says responders should remove the malware's credential-revocation watcher before rotating tokens and keys, because revocation triggers an attacker-supplied local handler. For businesses, the practical response is to inspect lockfiles and resolved versions, establish whether lifecycle scripts ran, contain affected hosts, remove the watcher, and only then rotate exposed credentials.