Supply-chain attack on npm: 868+ packages compromised by self-propagating credential-stealing worm

Short summary

A massive supply-chain attack compromised the maintainer account behind keyv, cacheable, and 868+ npm packages with 2B+ monthly installs, deploying a self-propagating worm that steals credentials and republishes infected packages. The malware harvests cloud, CI/CD, and AI tooling credentials, persists via IDE hooks, and uses a dead-man's switch that triggers on token revocation. Developers must audit dependencies and follow careful remediation steps before rotating credentials.

• •868+ npm packages compromised via maintainer account hijack, affecting 2B+ monthly downloads
• •Worm steals cloud, CI/CD, and AI tooling credentials, then self-replicates by republishing infected packages
• •Dead-man's switch triggers payload on credential revocation—do not rotate tokens before cleanup

Generated with AI, which can make mistakes.