That's why you should migrate to #NPM v12, it prevents exactly this kind of attack: https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
> Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a "preinstall": "node setup.mjs" entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed.
Markus Tacker
npub10r…nhvyf
2026-08-04 16:33:16 UTC
Author Public Key
npub10rsvp26shue08py7cj9ckv56h9z0rwhpq66advnx89nv6d99x8gqsnhvyfSeen on
wss://relay.ditto.pubPublished at
2026-08-04 16:33:16 UTCEvent JSON
{
"id": "8c000d7b41cc2f1d1b5fbf3fb73f2d9a10ca1a3baa35b6b4490c54a415072346",
"pubkey": "78e0c0ab50bf32f3849ec48b8b329ab944f1bae106b5d6b2663966cd34a531d0",
"created_at": 1785861196,
"kind": 1,
"tags": [
[
"t",
"npm"
],
[
"proxy",
"https://chaos.social/users/coderbyheart/statuses/117038199359784412",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "That's why you should migrate to #NPM v12, it prevents exactly this kind of attack: https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack\n\n\u003e Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a \"preinstall\": \"node setup.mjs\" entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed.",
"sig": "9604bbf9bbfd777cf0f16878478ffd8d03f533c1f56adec52ed476449df1cf99608f2549cc94cc9d55756419b103bd7f3efad261dd4788b112d493a2a20c96f2"
}