negativeSYS.SOURCE: The Hacker News• 2026-08-04T19:00:23+05:30

Keyv-Linked npm Worm Exploits Supply Chain to Steal Credentials and Embed VS Code Hooks

#npm #supply-chain #malware #credential-theft #vs-code

A credential-stealing npm worm exploited the Keyv supply chain to compromise hundreds of packages, embedding hooks for Claude Code and VS Code to exfiltrate sensitive data. The attack leveraged preinstall scripts and workspace trust mechanisms, with over 1,600 poisoned versions across 420 package names affecting developer environments and CI systems.

A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.

SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages

Read original article

*** END OF TRANSMISSION ***

> ANDROID 17 QPR1 INTRODUCES NEW APIS EXCLUSIVELY FOR PIXEL OS WITHOUT AOSP RELEASE > LINGUISTIC ILLEGIBILITY IN LARGE LANGUAGE MODELS: IMPLICATIONS FOR SECURITY > DIRECT SEMANTIC COMMUNICATION BETWEEN LARGE LANGUAGE MODELS VIA CACHE-TO-CACHE MECHANISM > OPTIMIZING MEMORY USAGE WITH MATHEMATICAL TECHNIQUES AND RUST PROGRAMMING > TYPESAFE AI'S JEV MODEL OFFERS CALIBRATED DECISIONS FOR SOFTWARE AUTOMATION > APPLE UNVEILS IPHONE DUO SIMULATOR AND XCODE 27.1 BETA FOR DEVELOPERS > U.S. BORDER AGENTS PERMITTED TO SEARCH CELLPHONES WITHOUT WARRANT OR SUSPICION > DISNEY'S FIRST CTO JOINS AI STARTUP PREVIOUSLY ACCUSED OF IP INFRINGEMENT > QUICK-COMMERCE PLATFORMS DELIVER NEW IPHONES IN MINUTES IN INDIA > GOOGLE INTRODUCES FAMILY-FOCUSED AI AGENT CC FOR HOUSEHOLD COORDINATION> ANDROID 17 QPR1 INTRODUCES NEW APIS EXCLUSIVELY FOR PIXEL OS WITHOUT AOSP RELEASE > LINGUISTIC ILLEGIBILITY IN LARGE LANGUAGE MODELS: IMPLICATIONS FOR SECURITY > DIRECT SEMANTIC COMMUNICATION BETWEEN LARGE LANGUAGE MODELS VIA CACHE-TO-CACHE MECHANISM > OPTIMIZING MEMORY USAGE WITH MATHEMATICAL TECHNIQUES AND RUST PROGRAMMING > TYPESAFE AI'S JEV MODEL OFFERS CALIBRATED DECISIONS FOR SOFTWARE AUTOMATION > APPLE UNVEILS IPHONE DUO SIMULATOR AND XCODE 27.1 BETA FOR DEVELOPERS > U.S. BORDER AGENTS PERMITTED TO SEARCH CELLPHONES WITHOUT WARRANT OR SUSPICION > DISNEY'S FIRST CTO JOINS AI STARTUP PREVIOUSLY ACCUSED OF IP INFRINGEMENT > QUICK-COMMERCE PLATFORMS DELIVER NEW IPHONES IN MINUTES IN INDIA > GOOGLE INTRODUCES FAMILY-FOCUSED AI AGENT CC FOR HOUSEHOLD COORDINATION