Keyv and Friends npm Packages Compromised in Supply Chain Attack
The Keyv and friends npm packages were compromised in an active supply chain attack, introducing malicious code in affected versions. Users of these packages are advised to avoid them until further notice.
What happened
On August 4, 2026, the maintainer account behind the Keyv and Cacheable npm namespaces was compromised, leading to the publication of trojanized releases. The malicious code includes a preinstall hook that downloads and executes obfuscated scripts to harvest credentials and inject the same hook into other packages. This has resulted in the compromise of hundreds of npm packages. Users should avoid using Keyv and friends and monitor for updates from the maintainers.
The attack leverages a preinstall script to run credential-stealing code within developer and CI environments. It can harvest various types of credentials and use npm publishing access to further spread the malicious code. The Keyv repository also contains hooks for Claude Code and Visual Studio Code that can execute the payload if trusted by the user.
Affected versions of Keyv include 6.0.0. It is recommended to remove the malware's credential-revocation watcher before rotating exposed tokens and keys, as revocation can trigger an attacker-supplied local handler. npm 12 blocks unapproved dependency lifecycle scripts by default, but earlier versions and other install paths remain vulnerable.
How 0Day mitigates this
keyv is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.