Credential-Stealing npm Worm Spreads Through Keyv and Cacheable Namespaces
A credential-stealing worm originating from keyv@6.0.0 has spread to hundreds of npm packages across multiple organizations, compromising credentials and expanding its reach through poisoned package versions.
What happened
On August 4, 2026, an attacker compromised the maintainer account for the keyv and cacheable npm namespaces, publishing trojanized releases. The malicious code includes a preinstall hook that executes a credential-stealing bundle, harvesting various credentials and private keys. It then uses stolen npm tokens to inject the same hook into other publishable packages, creating a self-replicating worm. SafeDep verified 353 poisoned versions across 79 package names, with the total footprint estimated at 442 versions across 353 names by some sources.
The attack does not require npm install to execute, affecting a broader range of systems. The Keyv repository also contains separate hooks for Claude Code and Visual Studio Code that can execute the payload under certain conditions. Any workstation or runner that executed an affected version should be considered credential-exposed.
Professional software engineers should investigate if any affected packages are in use within their projects. If available, upgrading to non-affected versions is recommended. npm 12 blocks unapproved dependency lifecycle scripts by default, but earlier npm clients and other install paths that permit lifecycle scripts remain vulnerable. Responders should remove the malware's credential-revocation watcher before rotating exposed tokens and keys, as revocation triggers the attacker-supplied local handler.
How 0Day mitigates this
keyv-linked is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.