SlowMist Detects Large-Scale npm Supply Chain Attack Targeting the Keyv Ecosystem

According to monitoring by blockchain security firm SlowMist (@SlowMist_Team), its threat intelligence system MistEye detected a large-scale npm supply chain attack targeting the Keyv/Cacheable ecosystem. The attackers published over 2,000 malicious package versions, including core components such as keyv@6.0.0. Keyv, a widely used key-value storage abstraction library supporting backends like Redis, SQLite, PostgreSQL, and MongoDB, receives approximately 127 million weekly downloads, exposing its downstream supply chain to significant risk. This attack technique closely resembles the previously observed Shai-Hulud npm worm campaign, exhibiting high levels of automation and scalability. Potential risks include credential theft, environment variable exposure, CI/CD secret leakage, remote payload delivery, and lateral movement. SlowMist recommends that security teams immediately identify and remove affected package versions, upgrade to verified secure versions, review dependency lock files and build logs, monitor for suspicious outbound connections, rotate exposed credentials, and rebuild affected environments from trusted sources if compromise is suspected.