Keyv is a small key-value storage abstraction for Node.js, the kind of utility package a developer pulls in once and never thinks about again. On 4 August, attackers compromised the GitHub account of the maintainer behind keyv and a cluster of related caching packages, including cacheable, flat-cache and file-entry-cache, and used that access to push a self-propagating credential-stealing worm across the npm registry. Between roughly 09:35 and 13:18 UTC that day, security researchers recorded 2,234 malicious versions spread across 444 packages, a footprint with a combined total exceeding 2 billion monthly installs.
A dependency you never chose directly
Almost nobody adds keyv to a project on purpose in the sense of evaluating it as a vendor. It arrives as a transitive dependency, pulled in by something else further up the chain, and it sits quietly in a lockfile until an npm install runs. That is exactly what happened here: every affected package received two new files and a "preinstall": "node setup.mjs" entry in its package.json, so simply installing a project that depended on any poisoned version was enough to trigger the payload automatically, with no code from the victim’s own application ever executing.
Why this one is harder to clean up than most
The payload downloads the Bun runtime and runs a heavily obfuscated stealer targeting .npmrc tokens, GitHub CLI tokens, AWS credentials, Vault tokens, Kubernetes configs and cryptocurrency wallets, coordinated through an Ethereum smart contract used as a dead-drop command channel rather than a conventional server infrastructure that could simply be taken down. It is also self-propagating: any maintainer whose machine ran a compromised package had their own npm tokens harvested and used to publish poisoned versions of packages they maintain, which is how the count grew to at least 868 additional packages across organisations including Deliveroo, Picsart and Qlik. Worst of all for incident response, the malware installs a watcher that fires attacker-controlled code the instant a defender revokes the stolen credentials, meaning the standard first move in any breach response, rotating tokens immediately, is precisely what triggers a second payload if done in the wrong order.
What this means if your team ships Node applications
Run npm ls against the affected package family across every repository, CI runner and developer machine your organisation controls, not just your primary applications, since build tools and internal scripts carry the same transitive dependencies. If you find a poisoned version anywhere, isolate that system and hunt for the persistence watcher before rotating any credentials reachable from it, then rebuild the machine and rotate tokens from a clean device afterward. Any organisation running Node-based CI/CD without a policy for pinning dependency versions or reviewing preinstall scripts has effectively delegated its cloud credential security to whichever maintainer account is weakest in its entire dependency tree.
If your organisation needs to establish whether this incident reached your environment, or wants a supply chain security review that covers dependency pinning, CI/CD credential scoping and preinstall script auditing, contact Excello Digital. We help European engineering teams find the transitive trust relationships that a lockfile alone will never show you.