Keyv Ecosystem Hit by Large-Scale npm Supply Chain Attack with Over 2,000 Malicious Packages

ChainCatcher report: According to SlowMist monitoring, MistEye has detected a large-scale npm supply chain attack targeting the Keyv/Cacheable ecosystem. The attacker has released over 2,000 malicious package versions, including keyv@6.0. Keyv is a widely used key-value storage abstraction library supporting backends such as Redis, SQLite, PostgreSQL, and MongoDB, with approximately 127 million weekly downloads, resulting in significant downstream supply chain exposure. The attack technique closely resembles the previous Shai-Hulud npm worm activity, indicating a highly automated and scalable supply chain attack. Potential malicious activities include credential theft, environment variable leakage, CI/CD secret exposure, remote payload delivery, and lateral movement through compromised development environments. Security teams should immediately identify and remove affected package versions, upgrade to verified secure versions, review dependency lock files and build logs, monitor for suspicious outbound connections, rotate compromised credentials, and rebuild environments upon confirmation of compromise.