🧰 keyv

The items that name it 16

• Supply Chain Zero Days: Closing the Gap Between Publication and Detection
  articleas classification.key entities2026-10-19
• The OpenSourceMalware Show #24
  talkas affected products2026-10-09

  Hit in the earlier August Mini Shai-Hulud attack on Jared Wray's projects, cited as the larger prior version of this pattern.

• Evolution of Web3 in Cloud Supply Chain Attacks
  articleas classification.key entities2026-10-07
• The dark figure of supply chain detection
  articleas affected products2026-09-01

  Popular key value utility package, downloaded 600 million times from NPM; a malicious version published August 4th 2026 executed obfuscated JavaScript and downloaded Bun at install time

• Customer Zero: Implementing Package Firewall at Endor Labs | Blog | Endor Labs
  articleas classification.key entities2026-08-25
• The OpenSourceMalware Show #16
  talkas affected products2026-08-08It is written here as Keyv (npm package).

  Maintained by Jared Wray; compromised via his GitHub account takeover on Tuesday and used to publish the worm

• New npm Worm Hits 400+ Packages Including Keyv, Cachable
  writeupas classification.key entities2026-08-05
• NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downloads and Spreads to Hundreds of Packages | Blog | Endor Labs
  advisoryas affected products2026-08-04

  npm package; malicious versions published August 4, 2026 via jaredwray/Cacheable GitHub Actions OIDC trusted publishing pipeline; part of seed packages exceeding 450 million weekly downloads combined with flat-cache and file-entry-cache

• keyv and cacheable npm Package Hijacked in Supply Chain Attack
  writeupas affected products2026-08-04It is written here as keyv (npm package).

  Compromised via GitHub maintainer account takeover; malicious payload introduced and new version published

• Keyv and friends compromised in active Shai-Hulud supply chain attack
  advisoryas classification.technologies2026-08-04
• Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
  writeupas affected products2026-08-04

  Primary compromised package; published 09:35:00 UTC Aug 4, 2026 with malicious preinstall hook; advisory SNYK-JS-KEYV-18515941

• 'ChainDrop' worm compromises hundreds of popular npm packages
  writeupas classification.key entities2026-08-04
• OpenSourceMalware Blog
  articleas classification.key entities2026-07-18
• Open Source Malware Podcast — episodes
  otheras classification.key entities2026-05-22
• Cooldowns.dev
  articleas affected products2026-05-06It is written here as keyv (npm).

  npm

• Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner
  repoas affected products

  maintainer account compromised, published with malicious preinstall dropper (ChainDrop wave)