Home / Technology / Attackers Steal Cloud Keys Via npm Worm
Attackers Steal Cloud Keys Via npm Worm
5 Aug
Summary
- A keyv npm package worm infected over two billion installs.
- The worm stole cloud access keys and production infrastructure tokens.
- A week's delay in releases could prevent such attacks.
A severe software supply chain attack recently compromised the popular keyv npm package, infecting over two billion monthly installs with a credential-stealing worm. This incident, occurring on Tuesday, August 4, 2026, saw malicious versions of keyv and related packages released onto npm, carrying a worm that stole sensitive cloud access keys and production infrastructure tokens. The attack exploited the trust inherent in package registries, as the poisoned releases initially bore valid provenance signatures, making them appear legitimate. Security firm Aikido reported at least 868 compromised packages across 1,381 versions, with JFrog tracing the campaign through more than 400 packages. CrowdStrike's recent report had predicted such supply chain attacks, noting 87% of malicious software registry threats involved npm packages.
The worm spread by harvesting credentials and using stolen npm publishing tokens to backdoor other packages controlled by victims. This blast radius extended to corporate npm scopes, affecting packages from companies like Deliveroo, Qlik, and Picsart, often through indirect dependencies. The malware also dropped persistence payloads into developer tools like Visual Studio Code and Anthropic's Claude Code agent, ensuring it could run when developers opened infected projects or started AI coding sessions.
Security experts propose simple yet effective countermeasures. A delay of just one week for new package releases, a capability supported by npm's `min-release-age` setting and pnpm's `minimumReleaseAge`, could provide the security community crucial time to detect and neutralize threats. Additionally, prioritizing vulnerability patching based on resources like CISA's Known Exploited Vulnerability Catalog is advised. GitHub has implemented security enhancements, including mandatory two-factor authentication and disabling preinstall scripts by default in npm version 12, mitigating malware execution upon installation. However, the core issue of account takeover remains, emphasizing the need for robust identity governance.
