Keyv/Cacheable Ecosystem Targeted in Major npm Supply-Chain Attack; 2,000+ Malicious Package Versions Published

ChainCatcher reports that SlowMist monitoring shows MistEye has identified a large-scale npm supply-chain attack aimed at the Keyv/Cacheable ecosystem. The attacker is said to have published more than 2,000 malicious package versions, including keyv@6.0. Keyv is a widely used key-value storage abstraction library with support for Redis, SQLite, PostgreSQL, and MongoDB. With roughly 127 million weekly downloads, the incident creates substantial downstream supply-chain risk. SlowMist noted the tactics closely resemble prior ShaiHulud npm worm activity, suggesting a highly automated, scalable campaign. Suspected capabilities include credential theft, environment variable leakage, CI/CD secret exposure, remote payload delivery, and lateral movement via compromised development environments. Security teams are advised to promptly identify and remove impacted versions, upgrade to verified safe releases, review dependency lock files and build logs, monitor for suspicious outbound connections, rotate any potentially exposed credentials, and rebuild affected environments if compromise is confirmed.