Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
- ID
- 10721
- Status
- summarized
- Published
- 04 Aug 2026, 9:30 PM
- Fetched
- 04 Aug 2026, 10:38 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 9.0
- Created
- 07 Aug 2026, 1:30 PM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
A credential-stealing npm worm originating from keyv@6.0.0 spread to hundreds of packages across multiple npm namespaces on August 4, 2026, using preinstall scripts to harvest GitHub, npm, cloud, Vault, Kubernetes, and private-key material from developer machines and CI runners. The malicious payload also planted Claude Code and VS Code workspace hooks that execute when a user trusts the workspace, and included npm publishing machinery to self-propagate by republishing poisoned versions using stolen identities.
Why it matters
If you ran any affected npm package version on a workstation or CI runner, treat all credentials as exposed—but do NOT rotate tokens first, because the malware installs a revocation watcher that triggers an attacker-supplied local handler on revocation; remove the watcher before rotating. Developers using Claude Code or VS Code should scrutinize workspace trust prompts, as the attack specifically targets those hooks. npm 12 blocks unapproved lifecycle scripts by default, so upgrading your npm client is a concrete mitigation if you're on an older version.
Discussion angle
How to audit your npm dependency tree for affected packages and what your incident response runbook should look like—specifically the counterintuitive order of removing the revocation watcher before rotating any exposed keys.