SlowMist Flags Large-Scale npm Supply Chain Attack Hitting the Keyv/Cacheable Ecosystem

BlockBeats, Aug. 5 — Security firm SlowMist said it has identified a large-scale supply chain attack on npm targeting the Keyv/Cacheable ecosystem. According to SlowMist, attackers have released more than 2,000 malicious package versions, including keyv@6.0.0. Keyv is a widely used key-value storage abstraction layer supporting Redis, SQLite, PostgreSQL and MongoDB, with roughly 127 million weekly downloads. SlowMist warned the incident could create broad downstream supply chain exposure. SlowMist said the attacker's methods closely resemble earlier ShaiHulud npm worm activity, suggesting a highly automated campaign with strong propagation capability. Suspected impacts include credential theft, environment-variable exfiltration, CI/CD key leakage, remote payload delivery and lateral movement through compromised development environments. SlowMist advised security teams to immediately identify and remove affected versions, upgrade to verified safe releases, review dependency lock files and build logs, monitor for unusual outbound connections, and rotate any credentials that may have been exposed. If compromise of the environment is suspected, it recommended rebuilding from trusted sources.