A supply chain worm hit npm on Tuesday after an attacker took over the GitHub account of the keyv maintainer. Keyv installs at roughly 127 million downloads per week. Within hours, Aikido counted 868 compromised packages across 1,381 versions totaling over two billion monthly installs. JFrog independently confirmed more than 400 packages and 1,700 poisoned versions. The blast radius reached corporate scopes at Deliveroo, Qlik, and Picsart through transitive dependencies no one audits by hand.
The detail that should stop security architects cold: the poisoned releases carried valid provenance signatures. The attacker did not forge anything. They pushed malicious commits to the maintainer's own repository, triggered the legitimate GitHub Actions workflow, and npm generated authentic Sigstore attestations through Fulcio and Rekor. The worm then harvested npm publish tokens from every infected machine and used them to backdoor additional packages, turning each compromised maintainer into a distribution node. Stolen credentials exfiltrated to public GitHub repositories tagged 'Shai-Hulud: Here We Go Again'. Persistence payloads landed in two directories: one for Visual Studio Code, one named .claude, the working directory for Anthropic's Claude Code agent. The target was cloud credentials and CI secrets. CrowdStrike found cloud-conscious criminal activity rose 171% in the first half of 2026.
CrowdStrike published its 2026 Threat Hunting Report one day before this incident and named npm packages as central to 87% of malicious software registry threats tracked in the first half of the year. The fix Adam Meyers describes is already shipped: npm CLI 11.10.0, released February 2026, includes a setting called min-release-age. pnpm added minimumReleaseAge five months earlier. Either rejects package versions published more recently than a configured threshold, a one-week delay that gives the security community time to catch a poisoning before it reaches every downstream build. The full report is worth reading for Meyers's vulnerability volume numbers, which do not appear in the published version, and for what CrowdStrike found attackers targeting inside developer tooling.
[READ ORIGINAL →]