Keyv supply-chain worm infects 430 npm packages, steals credentials
On Aug 4 2026 the maintainer of Keyv was compromised, letting attackers push malicious releases to npm. The worm added a preinstall script that drops Bun, runs an obfuscated payload, and exfiltrates npm tokens and other secrets, spreading to over 430 packages with 2 billion monthly installs. Projects depending on these caches now face credential theft.