🧰 flat-cache

The items that name it 3

• NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downloads and Spreads to Hundreds of Packages | Blog | Endor Labs
  advisory2026-08-04

  npm package; sits in the ESLint dependency chain, often pulled in as a transitive dev dependency; malicious versions published August 4, 2026

• Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
  writeup2026-08-04

  Published 10:10:55 UTC, malicious; subsequently removed, dist-tag reverted to 6.1.23

• Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner
  repo

  compromised via same maintainer account (ChainDrop wave)