NPM Worm Exploits Keyv Package to Spread Across Hundreds of Libraries
A malicious npm worm originating from keyv@6.0.0 has infected hundreds of packages, stealing credentials and embedding backdoors. Security firms report widespread contamination across the npm ecosystem.
TL;DR
- Malicious worm originated in keyv@6.0.0 and spread to hundreds of npm packages
- Attack installs Claude Code and VS Code hooks for persistent access
- Over 868 packages potentially affected according to latest reports
- Credential theft and backdoor installation confirmed by security vendors
- Organizations should audit dependencies and revoke compromised tokens
A dangerous supply chain attack has emerged in the npm ecosystem, where a worm initially found in keyv@6.0.0 has propagated to hundreds of dependent packages. The malware targets developers by injecting malicious code that steals credentials and establishes persistent backdoors through popular IDE integrations.
Security monitoring firms SafeDep and Aikido have tracked the infection across thousands of package versions, revealing the extensive reach of this campaign. Organizations relying on npm dependencies are advised to immediately audit their supply chains and check for signs of compromise.
Attack Vector and Propagation
- Initial infection occurred through keyv@6.0.0 published to npm registry
- Worm spread autonomously across 79 package namespaces beyond original scope
- Automated dependency resolution enabled rapid propagation throughout ecosystem
- Malware installs persistent hooks in VS Code development environments
- Attack leverages legitimate package update mechanisms to avoid detection
Impact and Recommended Actions
- Confirmed credential theft from developer environments and CI/CD systems
- Over 868 unique packages identified with malicious code injection
- Organizations should revoke npm tokens and rotate API credentials immediately
- Audit all npm dependencies for unauthorized modifications or new sub-dependencies
- Implement automated scanning for known malicious package signatures in build pipelines
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.