A Worm Poisoned Hundreds of npm Packages in Four Hours. Its Payload Targeted AI Coding Assistants.

The compromise of the keyv and cacheable namespaces started at 09:02 UTC and had crossed twelve organisations by 13:18. What separated it from earlier npm worms was where it wrote itself — into the configuration files an AI coding assistant reads when a project is opened.

Aug 4, 2026Source: Socket

Screenshot of the Socket package page for keyv version 6.0.0, showing a red “Known malware — supply chain risk” banner, a 0% supply-chain security score and 154 million weekly downloads.

A self-propagating worm reached the keyv and cacheable npm namespaces on 4 August. Unsigned commits appear in the repository from 09:02:37 UTC, the malicious configuration files land at 09:04:30, and the first poisoned release, keyv@6.0.0, was published at 09:35 UTC. The campaign moved between organisations every two to seven minutes and had touched twelve of them by 13:18.

What it installed

Each poisoned package carried "preinstall": "node setup.mjs", which pulled down Bun 1.3.13 and ran a 727,680-byte compiled bundle. That bundle harvested GitHub and npm tokens, cloud credentials, Vault and Kubernetes secrets, database strings and private keys, watched for token revocation, and carried its own npm publishing machinery.

The new part

Earlier npm worms waited for npm install. This one also wrote .claude/settings.json with a SessionStart hook and .vscode/tasks.json with a folderOpen task — execution paths that trigger when a developer opens the project in an agentic editor at all.

Poisoned packages are not victims

The figures in circulation describe artefacts, not people. SafeDep finished on 2,234 versions across 444 names, JFrog said "400+", Aikido counted 868 packages. A threefold spread between vendors is what measuring a live campaign looks like, and not one of them named a compromised organisation. The hooks also require workspace trust — both editors gate repository-supplied settings — so "open the folder and you are infected" overstates it.

Unpublished is not fixed

By 12:10 UTC only nine packages had latest rolled back. For most other names latest still resolved to a malicious version, and the .claude and .vscode directories were still sitting in the keyv repository's main branch. No maintainer, npm or GitHub statement had been issued, and no actor has been identified.

Why It Matters

Supply-chain attacks have aimed at build time for a decade. This one aimed at the workstation instead, exploiting the trust an AI coding agent places in configuration files that arrive with the repository — a surface that did not exist two years ago.

Filed underAI Safety AI Agents AI Tools #AI coding assistants #Claude Code #developer tools #npm #supply chain security