Data: Keyv ecosystem suffers a large-scale npm supply chain attack, with over 2,000 malicious package versions released
According to Slow Fog monitoring, MistEye detected a large-scale npm supply chain attack affecting the Keyv/Cacheable ecosystem. The attackers published over 2,000 malicious package versions, including keyv@6.0. Keyv is a widely used key-value storage abstraction library that supports backends such as Redis, SQLite, PostgreSQL, and MongoDB, with approximately 127 million downloads per week, leading to significant downstream supply chain exposure.The attack method is highly similar to the previous Shai-Hulud npm worm activity, indicating a highly automated and scalable supply chain attack. Potential attack behaviors include credential theft, environment variable leakage, CI/CD key leakage, remote payload delivery, and lateral propagation through compromised development environments. Security teams should immediately identify and remove affected package versions, upgrade to verified secure versions, review dependency lock files and build logs, monitor suspicious external connections, rotate leaked credentials, and rebuild environments upon confirmation of the impact.
