Keyv Ecosystem Hit by Massive npm Supply Chain Attack with Over 2000 Malicious Packages Released

SlowMist has detected a massive npm supply chain attack affecting the Keyv/Cacheable ecosystem, with attackers releasing over 2000 versions of malicious packages, including keyv@6.0.0. Keyv is a widely used key-value storage abstraction library that supports backends such as Redis, SQLite, PostgreSQL, and MongoDB, with approximately 127 million downloads per week, leading to significant downstream supply chain exposure. The attack method is highly similar to the previous Shai-Hulud npm worm activity, indicating a highly automated and scalable supply chain attack. Potential attack behaviors include credential theft, environment variable leakage, CI/CD key leakage, remote payload delivery, and lateral propagation through compromised development environments. Security teams should immediately identify and remove affected package versions, upgrade to verified safe versions, review dependency lock files and build logs, monitor for suspicious external connections, rotate leaked credentials, and rebuild environments upon confirmation of impact.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.