Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
Article summary
Quick briefing — cleaned from the original RSS feed
A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026. SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages
1Key Takeaways
- A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.
- SafeDep verified 353 poisoned versions across 79 package names in the npm registry.
- Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages.
2AIWedia Score
9.7/10
Must-read — high impact for AI builders
Based on source trust, recency, category impact, and story depth.
3Why it matters
New model releases change what is possible for builders, researchers, and everyday AI users. The Hacker News reports that a credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.
Explore related
Browse toolsRelated tools
AI Models news
Explore curated ai models tools on AIWedia — compare, rank, and launch from our directory.
Full story on The Hacker News
Read full articleHeadlines aggregated via RSS for discovery on AIWedia. Original content © The Hacker News. We link to the source and do not republish full articles.