SlowMist: Keyv/Cacheable Ecosystem Hit by Large-Scale npm Supply Chain Attack, Over 2,000 Malicious Versions Identified

SlowMist has published a report detecting a large-scale npm supply chain attack impacting the Keyv/Cacheable ecosystem. Attackers have released over 2,000 malicious package versions in the ecosystem, including keyv@6.0.0. Keyv is a widely used key-value storage abstraction layer supporting backends such as Redis, SQLite, PostgreSQL, and MongoDB, with approximately 127 million weekly downloads, which could trigger widespread downstream supply chain risks. The attack method is highly similar to the previous Shai-Hulud npm worm activity, demonstrating the attackers’ strong automation and propagation capabilities. Potential malicious actions include credential theft, exfiltration of environment variables, leakage of CI/CD secrets, remote payload delivery, and lateral movement via infected development environments. Security teams are advised to immediately identify and remove affected versions, upgrade to verified secure versions, check dependency lock files and build logs, monitor for abnormal outbound connections, and rotate any exposed credentials. If an environment is suspected to be compromised, rebuild it from trusted sources.