Keyv npm Worm Poisons 800+ Packages, Plants VS Code & Claude Hooks

A credential-stealing worm that originated in keyv@6.0.0 on August 4, 2026, spread far beyond the Keyv and Cacheable namespaces, contaminating hundreds of npm packages across multiple organizations. SafeDep verified 353 poisoned versions across 79 package names, while its broader monitoring placed the footprint at 442 versions across 353 names. Aikido later raised the estimate to at least 868 packages spanning 1,381 versions, though neither total could be independently reproduced from a complete public list at the time of reporting. The malicious release added node setup.mjs as a preinstall script and bundled setup.mjs alongside Math_Symbol.js, leaving the compiled library code untouched to avoid immediate suspicion.

The payload, a 727,680-byte compiled bundle, runs inside developer workstations and continuous integration (CI) runners. Stage one checks for the Bun runtime and downloads version 1.3.13 from Bun's official GitHub releases if it is not present, then hands off to the bundle. According to SafeDep's analysis, the malware harvests GitHub tokens, npm publishing credentials, cloud provider keys, Vault secrets, Kubernetes configuration, database credentials, and private-key material. It also reads GitHub Actions runner memory, installs a token-revocation watcher, and carries npm publishing machinery capable of modifying, versioning, and republishing packages under any stolen identity. Socket researchers separately decoded this republishing logic, confirming the worm can self-propagate using any available npm token. Developers who may have executed an affected version should immediately check their credentials with a password strength checker and audit their environments for unauthorized publishing activity.

Beyond the install-time payload, the compromised Keyv repository retained Claude Code and Visual Studio Code configuration hooks designed to execute the same malicious bundle once a user trusts the workspace or permits the project configuration. Socket warned that any workstation or runner that executed an affected version should be treated as fully credential-exposed. SafeDep additionally advised responders to remove the malware's credential-revocation watcher before rotating exposed tokens and keys, because revocation itself triggers the watcher and could fire an attacker-supplied local handler. Although npm 12 blocks unapproved dependency lifecycle scripts by default, earlier npm clients and other install paths that permit lifecycle scripts remain exposed. The registry changed rapidly enough that a fixed list of packages still tagged latest could not be maintained; by 5:40 p.m. IST on August 4, earlier releases had been restored as latest for at least nine packages, including keyv@5.6.0, flat-cache@6.1.23, and cache-manager@7.2.9. Because the full campaign could not be mapped package by package, exposure checks must rely on exact package names, resolved versions, and lockfiles rather than cached tag data. Users can run a privacy checkup and verify the integrity of their development environments, while teams should rotate all potentially exposed tokens, audit npm publish scopes, and review VS Code workspace trust settings for unexpected Claude or extension hooks.