As cited
Copy frozen at (site build).
threat intel
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
A credential-stealing worm distributed through npm package managers affected hundreds of packages starting August 4, 2026, with initial detection in keyv@6.0.0 and subsequent spread to multiple organizations. Security researchers identified between 353 and 868 affected package versions depending on detection methodology, with the malware establishing hooks in Claude Code and Visual Studio Code environments.
Why it matters: Developers using any of the hundreds of affected npm packages face credential theft and potential supply chain compromise; immediate dependency audits and package updates are required to prevent unauthorized access to development environments and downstream applications.
- Source published
- First seen by Cybersecurity Tracker