Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
Summary: A credential-stealing npm worm that began in keyv@6.0.0 spread across hundreds of packages on August 4, 2026, with SafeDep verifying 353 poisoned versions across 79 package names and later expanding its count to 1,684 versions across 420 names tied to nine organizations. The malicious release added a preinstall script running a 727,680-byte bundle that harvests GitHub, npm, cloud, Vault, Kubernetes, database and private-key material, and the Keyv repository also carried Claude Code and VS Code hooks that can execute the payload once a user trusts the workspace.
What you should know: SafeDep said the worm moved between organizations every two to seven minutes and finished its cross-organization publishing burst in roughly half an hour, and the poisoned Keyv release carried valid OIDC and SLSA provenance because it passed through the project's legitimate GitHub Actions workflow. Any workstation or runner that executed an affected version should be treated as credential-exposed, and responders must remove the malware's credential-revocation watcher before rotating tokens, since revocation is what triggers it.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026