On August 4, 2026, attackers compromised the GitHub account of a maintainer for the popular npm package 'keyv' and its related libraries. This allowed them to inject a credential-stealing worm into at least 868 packages, affecting over 2 billion monthly installs. The malicious code, disguised as 'setup.mjs', executes a payload that steals npm, GitHub, and AWS credentials, and attempts to propagate to other packages. AI
IMPACT Compromised packages could impact AI development tools and infrastructure, potentially leading to data breaches or disruptions.
RANK_REASON Supply chain attack affecting widely used software packages.
Read on Hacker News — AI stories ≥50 points →
AI-generated summary · Google Gemini · from 1 sources. How we write summaries →
