Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

Summary

A credential-stealing npm worm, originating in [email protected], has infected hundreds of packages. Security firms SafeDep and Aikido reported significant numbers of poisoned versions. The worm uses preinstall scripts to steal credentials and can poison further packages. Workstations executing affected versions are considered compromised.

Key Takeaways

1. A credential-stealing npm worm that first appeared in [email protected] spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.
2. The malicious release used a preinstall script to run a credential-stealing bundle inside developer and continuous integration (CI) environments.
3. Socket says any workstation or runner that executed an affected version should be treated as credential-exposed.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 15% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on multiple security research firms for its claims, providing a degree of verification. However, it acknowledges that some broader figures were not independently reproducible, and the full campaign could not be mapped. The lack of official statements from npm or GitHub slightly reduces overall credibility.

Bias assessment: Technical Security Reporting. The article focuses on technical details of a software vulnerability and its spread. It presents information factually, citing security researchers and technical findings without overt emotional language or political framing. The primary lens is that of cybersecurity analysis.

Note: This article provides a technical analysis of a software supply chain attack. Readers should cross-reference with official security advisories for comprehensive understanding.

Credibility flag: Technical Analysis

Claimed Facts (8)

• This is a specific, verifiable number reported by a named entity.
• These are specific figures reported by named entities, though the article notes they were not independently reproducible.
• This describes a technical mechanism of the attack, presented as factual.
• This details specific technical components and their function, presented as factual.
• This identifies a specific version as the initial point of infection, presented as a fact.
• This describes a specific technical process within the malware, presented as factual.
• This states a technical fact about the provenance of the malicious release.
• This describes observable details of a commit, presented as factual.

Opinions (5)

• This is an interpretation of the available evidence, indicating what is not definitively known.
• This is a conclusion drawn from the evidence, stating a limitation in understanding.
• This is an assessment of the current state of knowledge regarding the perpetrators.
• This is an analytical statement suggesting a link based on observed similarities.
• This is an assessment of a potential future risk based on the current state of the repository.

Claims (5)

• While presented as a fact, this is an interpretation of what the reported numbers represent, which could be debated.
• This is a statement about the limitations of the data, which could be seen as an opinion or a subtle downplaying of the reported scale.
• This is a statement about what is required for full understanding, which, while technically true, can be presented in a way that suggests current data is insufficient.
• This is a cautionary statement about the effectiveness of certain mitigation strategies, framed as a risk that might be overstated.
• This statement, while framed as a lack of evidence, can be interpreted as a way to avoid definitive conclusions about the extent of the breach.

Key Sources

• SafeDep — Security Research Firm
• Aikido — Security Research Firm
• Socket — Security Research Firm
• The Hacker News — Cybersecurity News Outlet