Don't Revoke the npm Token—It Fuels the keyv/cacheable Worm
When the keyv/cacheable maintainer was hijacked, the attacker used the stolen npm token to inject a preinstall hook into hundreds of packages, creating a self‑replicating worm. Revoking the token immediately destroys forensic evidence and even fuels the payload. SANS recommends delaying revocation until logs are captured and the infection is isolated.