A compromised GitHub account led to a widespread supply chain attack affecting over 444 npm packages, enabling a malicious worm to steal credentials from developers and CI/CD environments.

Key Points

• Attackers hijacked the maintainer account for the popular keyv library, injecting a credential-stealing worm into 11 core packages and over 400 downstream dependencies.
• The malware, triggered via npm install, uses an obfuscated dropper to execute a payload that harvests secrets from AWS, Kubernetes, GitHub, Stripe, and local filesystem files.
• The worm propagates automatically by using stolen npm tokens to publish malicious updates to other packages and by injecting hooks into VS Code and Claude configurations.
• Stolen data is encrypted and exfiltrated to public GitHub repositories or a dynamic command-and-control domain managed via an Ethereum smart contract.
• Affected packages include widely used utilities like flat-cache, file-entry-cache, and cacheable-request, which collectively account for over 2 billion monthly installs.

Why it Matters

This incident represents a severe escalation in supply chain security threats, as the worm actively weaponizes stolen credentials to infect other maintainers and organizations. The automated nature of the propagation and the breadth of targeted secret stores pose a critical risk to the integrity of global software development pipelines.