Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
A credential-stealing npm worm has spread across hundreds of packages, compromising developer and CI environments. The worm harvests repository, package registry, cloud, and private-key material, and uses available npm publishing access to poison more packages.
Intelligence analysis by Llama
A malicious npm worm has infected hundreds of packages, compromising developer and CI environments. The worm harvests sensitive information and uses npm publishing access to spread further.
Imagine you're working on a project, and someone sneaks a malicious script into your code. This script can steal your secrets, like passwords and API keys, and use them to harm your project or others. That's what happened with the Keyv-Linked npm worm. It's like a digital thief that can steal your secrets and use them to cause trouble.
Analysis
A $60B Vote of Confidence
The recent outbreak of a credential-stealing npm worm has sent shockwaves through the software development community. The worm, which first appeared in keyv@6.0.0, has spread across hundreds of packages, compromising developer and CI environments. SafeDep, a security firm, has verified 353 poisoned versions across 79 package names in the npm registry, while Aikido has reported at least 868 packages across 1,381 versions. The worm's ability to harvest repository, package registry, cloud, and private-key material makes it a significant threat to the security of software development.
Why Cursor?
The worm's use of a preinstall script to run a credential-stealing bundle inside developer and CI environments is a key factor in its spread. The script, which is designed to run automatically when a package is installed, allows the worm to harvest sensitive information and use available npm publishing access to spread further. This highlights the importance of securing developer and CI environments against credential-stealing malware.
The Road Ahead
In response to the outbreak, SafeDep advises responders to remove the malware's credential-revocation watcher before rotating exposed tokens and keys. Revocation is the watcher's trigger, and rotating first can run an attacker-supplied local handler. npm 12 blocks unapproved dependency lifecycle scripts by default, but earlier npm clients and other install paths that permit lifecycle scripts remain exposed. The first confirmed malicious release was keyv@6.0.0, which added node setup.mjs as a preinstall command and included setup.mjs and Math_Symbol.js in the package while leaving the compiled library code unchanged.
Key points
- A credential-stealing npm worm has spread across hundreds of packages, compromising developer and CI environments.
- The worm harvests repository, package registry, cloud, and private-key material, and uses available npm publishing access to spread further.
- SafeDep advises responders to remove the malware's credential-revocation watcher before rotating exposed tokens and keys.
- npm 12 blocks unapproved dependency lifecycle scripts by default, but earlier npm clients and other install paths that permit lifecycle scripts remain exposed.
If the development community comes together to address the issue, it's possible that the worm's spread can be contained, and developers can take steps to secure their environments against similar attacks in the future.
The worm's ability to harvest sensitive information and spread further through npm publishing access makes it a significant threat to the security of software development. If the issue is not addressed promptly, it could lead to a wider outbreak and compromise more projects.
