opensourcemalware.comwriteup

New npm Worm Hits 400+ Packages Including Keyv, Cachable

Reports on an npm worm that compromised over 400 packages, including widely-used libraries Keyv and Cacheable, propagating automatically through the dependency tree. This reflects the pattern of self-replicating supply-chain attacks (similar to Shai-Hulud-style worms) that hijack maintainer accounts or exploit postinstall scripts to spread malicious code across the npm registry.