#npm: A massive #SupplyChain attack has compromised 868+ npm packages carrying 2 billion+ monthly installs with a credential-stealing worm.
It started with the compromise of the #GitHub account of the #keyv library with 127 million+ weekly downloads:
👇
https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
Sam Stepanyan :verified: 🐘
npub1gr…9gp67
2026-08-04 19:48:29 UTC
Author Public Key
npub1gr8f0c2al23r8wpv2v7vt2na36g3xnpz06pceqhrysmlg8gahyjqp9gp67Seen on
wss://relay.momostr.pinkPublished at
2026-08-04 19:48:29 UTCEvent JSON
{
"id": "07941fbe74ad30f81d4e1f9fac1b40245dce2fe81f51bf1b0ea3a50e9a11fd50",
"pubkey": "40ce97e15dfaa233b82c533cc5aa7d8e91134c227e838c82e32437f41d1db924",
"created_at": 1785872909,
"kind": 1,
"tags": [
[
"t",
"npm"
],
[
"t",
"supplychain"
],
[
"proxy",
"https://infosec.exchange/@securestep9/117038967021943484",
"web"
],
[
"t",
"github"
],
[
"t",
"keyv"
],
[
"proxy",
"https://infosec.exchange/users/securestep9/statuses/117038967021943484",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/securestep9/statuses/117038967021943484",
"pink.momostr"
],
[
"-"
]
],
"content": "#npm: A massive #SupplyChain attack has compromised 868+ npm packages carrying 2 billion+ monthly installs with a credential-stealing worm. \n\nIt started with the compromise of the #GitHub account of the #keyv library with 127 million+ weekly downloads:\n👇\nhttps://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack",
"sig": "d21d8726b485326c4a4aebbb31153d19a4a00bc5f63cfca8a0e0db362c0774c8ffa38d5b96da4b7b55ea482e453d10926beb49676d1d4e911df23f126abb8283"
}