Keyv Ecosystem Hit by Massive npm Supply Chain Attack with Over 2000 Malicious Packages Released

SlowMist has detected a massive npm supply chain attack affecting the Keyv/Cacheable ecosystem, with attackers releasing over 2000 versions of malicious packages, including keyv@6.0.0. Keyv is a widely used key-value storage abstraction library that supports backends such as Redis, SQLite, PostgreSQL, and MongoDB, with approximately 127 million downloads per week, leading to significant downstream supply chain exposure. The attack method is highly similar to the previous Shai-Hulud npm worm activity, indicating a highly automated and scalable supply chain attack. Potential attack behaviors include credential theft, environment variable leakage, CI/CD key leakage, remote payload delivery, and lateral propagation through compromised development environments. Security teams should immediately identify and remove affected package versions, upgrade to verified safe versions, review dependency lock files and build logs, monitor for suspicious external connections, rotate leaked credentials, and rebuild environments upon confirmation of impact.