Analysis
A Maintainer Account, Not a Zero-Day
Attackers compromised the GitHub account of the maintainer behind keyv, a key-value caching library with roughly 127 million weekly npm downloads, and used that access to push a credential-stealing worm across keyv's entire package family, according to [The Hacker News](https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html). The same maintainer also owns cacheable, flat-cache and file-entry-cache -- some individually pulling more than 500 million downloads a month -- all swept into the same compromise.
“Twelve unrelated organizations were confirmed compromised within a roughly four-hour window on August 4, with 2,234 poisoned versions found across 444 package names.”
Every poisoned package received a preinstall hook that ran automatically on npm install, downloading the Bun runtime and executing a roughly 728 KB obfuscated stealer targeting .npmrc tokens, GitHub CLI tokens, AWS credentials, Vault tokens, Kubernetes configs and crypto wallets, per [Socket's](https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain) technical writeup. The worm also planted hooks targeting Claude Code and VS Code specifically -- a detail that makes this the first major supply-chain attack aimed explicitly at AI coding-agent environments rather than generic developer credentials. Twelve unrelated organizations were confirmed compromised within a roughly four-hour window on August 4, with 2,234 poisoned versions found across 444 package names.
This follows the same self-propagating pattern that hit npm earlier this year: one compromised maintainer account cascades into hundreds of downstream packages within hours, because modern JavaScript projects routinely depend on caching utilities several layers deep without anyone auditing them individually.
The counterweight worth noting: npm's ecosystem has had multiple worm-style incidents this year, and each one has been caught and contained within roughly a day -- this is a real, costly incident, not evidence the entire package ecosystem is unusable. What to watch: whether npm or GitHub ships mandatory hardware-key two-factor authentication for maintainers of packages above a download threshold, the structural fix security researchers have called for after every one of these incidents.
