Malware in keyv
Malware was discovered in the keyv npm package. Systems with the package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
- Disclosed
- Last updated
- Blast radius
- Any system with the malicious keyv package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- keyvnpm package
A critical malware incident was identified in the keyv npm package. According to the GitHub advisory, any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends that all secrets and keys stored on affected computers be rotated immediately from a different, uncompromised system. While the malicious package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the compromise, as the attacker may have gained full control of the affected system.\n\nThe incident was disclosed on August 4, 2026, via GitHub's advisory system.
Indicators of compromise
- Packages
- keyv
Remediation
- Immediately rotate all secrets and keys from a different, uncompromised computer
- Remove the keyv package from all affected systems
- Conduct a full security audit of any system that had keyv installed
- Consider the affected system(s) as potentially fully compromised and take appropriate incident response measures
- Review access logs and monitor for unauthorized activity on systems that had the package installed
Sources
- GitHub Advisory GHSA-3p9h-f68w-m6fx · GitHub Advisory Database
Cite this entry
"Malware in keyv." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 4, 2026; last updated August 4, 2026. https://supplychainattack.org/incident/malware-in-keyv-xm6qjj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in internallib_v688
Malware discovered in the npm package internallib_v688. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in cacheable-request
Malware was discovered in the npm package cacheable-request. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in cache-manager
Malware was discovered in the npm package cache-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2
ChainDrop is a self-propagating npm worm that publishes malicious versions of dozens of npm packages using stolen maintainer credentials. The worm harvests CI/CD credentials and uses an Ethereum-based dead-drop command-and-control mechanism.
ChaindropnpmOtherCompromised packageMalicious maintainerAccount takeover