SlowMist phát hiện cuộc tấn công chuỗi cung ứng npm quy mô lớn ảnh hưởng đến hệ sinh thái Keyv

The blockchain security company SlowMist (@SlowMist_Team) has detected a large-scale npm supply chain attack targeting the Keyv/Cacheable ecosystem through its threat intelligence system, MistEye. The attackers have published over 2,000 malicious package versions, including core components such as keyv@6.0.0. Keyv, a widely used key-value storage abstraction library supporting backends like Redis, SQLite, PostgreSQL, and MongoDB, receives approximately 127 million weekly downloads, exposing its downstream supply chain to significant risk. This attack technique closely resembles the previously observed Shai-Hulud npm worm activity, exhibiting high levels of automation and scalability. Potential risks include credential theft, environment variable exposure, CI/CD key leakage, remote payload delivery, and lateral movement. SlowMist recommends that security teams immediately identify and remove affected package versions, upgrade to verified secure versions, review dependency lock files and build logs, monitor suspicious outbound connections, rotate exposed credentials, and rebuild affected environments from trusted sources if compromise is suspected.