npm supply chain attack hits Keyv with 2,000 malicious package versions

A large-scale npm (JavaScript package manager) supply chain attack has hit the Keyv/Cacheable ecosystem, with SlowMist saying on Aug. 5 that its MistEye system detected more than 2,000 malicious package versions, including keyv@6.0.0. Keyv is a widely used key-value storage abstraction library that supports backends including Redis, SQLite, PostgreSQL and MongoDB, and the reported scale matters because the package sees about 127 million weekly downloads, creating significant downstream supply chain exposure. SlowMist said the attack closely resembled the earlier Shai-Hulud npm worm activity, suggesting a highly automated and scalable supply chain attack. Potential malicious actions include credential theft, environment variable leaks, CI/CD (software delivery pipeline) key exposure, remote payload delivery and lateral movement through compromised developer environments.