negativeSYS.SOURCE: The Hacker News• 2026-08-04T19:00:23+05:30

Keyv-Linked npm Worm Exploits Supply Chain to Steal Credentials and Embed VS Code Hooks

#npm #supply-chain #malware #credential-theft #vs-code

A credential-stealing npm worm exploited the Keyv supply chain to compromise hundreds of packages, embedding hooks for Claude Code and VS Code to exfiltrate sensitive data. The attack leveraged preinstall scripts and workspace trust mechanisms, with over 1,600 poisoned versions across 420 package names affecting developer environments and CI systems.

A credential-stealing npm worm that first appeared in [email protected] spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.

SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages

Read original article

*** END OF TRANSMISSION ***

> EDOTENV: MARKET-DERIVED REINFORCEMENT LEARNING ENVIRONMENTS FOR QUANTITATIVE TRADING RESEARCH > CHALLENGES IN WEB SECURITY: A CASE STUDY ON PHISHING-LIKE INTERFACES > PERSONAL BLACKMAIL INCIDENTS AND STRATEGIC RESPONSES IN 2012-2015 > HUMAN EFFICIENCY IN COVERAGE PATH PLANNING: INSIGHTS FROM A LAWN MOWING EXPERIMENT > CMCP: HARDWARE-ATTESTED POLICY ENFORCEMENT FOR AI AGENT TOOL CALLS > AI DATA CENTERS INCREASE GRID COSTS AND UTILITY BILLS ACROSS U.S. STATES > HOP.EARTH: OPENSTREETMAP-DRIVEN CAR RACING GAME UTILIZING COPERNICUS AND IGN ELEVATION DATA > VLT 1.0 RELEASE WITH HOSTED PACKAGE REGISTRIES AND ECOSYSTEM MIRRORS > WAYMO EXPANDS ROBOTAXI ACCESSIBILITY IN DALLAS TO ALL RESIDENTS AND VISITORS > ANALYSIS OF 542 DEAD MENTAL HEALTH STARTUPS (2000-2026) WITH 18-CODED FIELDS> EDOTENV: MARKET-DERIVED REINFORCEMENT LEARNING ENVIRONMENTS FOR QUANTITATIVE TRADING RESEARCH > CHALLENGES IN WEB SECURITY: A CASE STUDY ON PHISHING-LIKE INTERFACES > PERSONAL BLACKMAIL INCIDENTS AND STRATEGIC RESPONSES IN 2012-2015 > HUMAN EFFICIENCY IN COVERAGE PATH PLANNING: INSIGHTS FROM A LAWN MOWING EXPERIMENT > CMCP: HARDWARE-ATTESTED POLICY ENFORCEMENT FOR AI AGENT TOOL CALLS > AI DATA CENTERS INCREASE GRID COSTS AND UTILITY BILLS ACROSS U.S. STATES > HOP.EARTH: OPENSTREETMAP-DRIVEN CAR RACING GAME UTILIZING COPERNICUS AND IGN ELEVATION DATA > VLT 1.0 RELEASE WITH HOSTED PACKAGE REGISTRIES AND ECOSYSTEM MIRRORS > WAYMO EXPANDS ROBOTAXI ACCESSIBILITY IN DALLAS TO ALL RESIDENTS AND VISITORS > ANALYSIS OF 542 DEAD MENTAL HEALTH STARTUPS (2000-2026) WITH 18-CODED FIELDS