A credential-stealing worm linked to the npm package Keyv has infiltrated hundreds of packages across multiple organizations, posing a significant threat to developer and continuous integration environments. The worm, first detected in the Keyv package version 6.0.0, has spread through the npm registry. SafeDep confirmed that 353 poisoned versions were found across 79 package names, and further analysis by Aikido indicated that at least 868 packages and 1,381 versions were affected. The worm uses a preinstall script to execute a credential-stealing bundle, compromising repository and cloud credentials and exploiting npm publishing access to propagate further.
The attack also involves Claude Code and Visual Studio Code hooks within the Keyv repository. These hooks can execute malicious payloads when users trust the workspace or allow project configurations. Security firms recommend treating any system that executed the affected version as compromised. SafeDep advises removing the malware's credential-revocation watcher before rotating exposed tokens and keys. If tokens are rotated first, the attacker could trigger a local handler.
The initial malicious release of Keyv added a preinstall command, and while the library code remained unchanged, it included setup scripts that download additional malicious payloads. This payload is capable of harvesting sensitive information from GitHub, npm, cloud services, and more. SafeDep and Socket have decoded parts of the worm's functionality, including its ability to modify and republish stolen npm identities. The rapid changes in the registry hinder a clear mapping of affected packages, complicating exposure assessments.
The campaign's complexity and evolving nature make it difficult to ascertain the full extent of the impact. The worm's propagation appears to involve automated processes, although the exact mechanism remains unclear. SafeDep expanded its findings, noting the worm's rapid movement across organizations. Although some releases have been unpublished, upgrading packages alone may not mitigate the risk. Security teams are advised to scrutinize lockfiles and resolved versions against known affected packages, disable unnecessary install scripts, and treat compromised environments with caution.