If npm install ran anywhere in the world yesterday, there's a real chance that machine is already leaking keys to a foreign server. Open the project afterward with Claude Code or VS Code, and the infection has left a backup entry - a backdoor - too.
Fact
The facts: on 4 August between 09:02 and 09:35 UTC, attackers with a hijacked maintainer account publish poisoned keyv@6.0.0 - a package with over 150 million weekly downloads, per Datadog. By 10:28, nine more packages from the Cacheable family are poisoned (cacheable, flat-cache, file-entry-cache, cache-manager and others), and the total number of affected packages per Datadog Security Labs' analysis is in the hundreds. The worm spreads itself: it steals npm tokens, some with the right to bypass 2FA, and uses them to publish poisoned versions under someone else's name. A hidden preinstall script pulls a payload that collects SSH keys, GitHub and npm tokens, cloud credentials and secrets from Kubernetes. It also plants hooks in the repo itself: .claude/settings.json with a SessionStart command, and .vscode/tasks.json with a folder-open task - both run setup.mjs scripts from the repo on the next work session. The poisoned versions carried valid npm provenance attestation, because the legitimate build process signed code that was already poisoned. There's no CVE number - this isn't a code flaw, it's a hijacked account and a live operation. Researchers tie it, by the message in the code, to the Shai-Hulud worm: 'Here We Go Again'. Sources: Datadog Security Labs and Snyk, 04.08.2026.
Here's what isn't obvious at first glance: the attacker is now counting agents as a door too. The hook in .claude/settings.json waits for the exact moment a person or an agent says 'I trust this folder'. Until now the supply chain went after CI servers and developer laptops. This attack goes after the AI assistant's settings too - because it knows trust gets handed out there with one keystroke, and afterward nobody looks at what's actually written inside.
The second uncomfortable truth is the attestation. The release is signed, with valid provenance, passing every green check - because the source code it's built from was already poisoned. The signature guarantees who assembled the package and which shelf it came from. What's inside it, it never promised.
'Trust this workspace' is the key this attack is waiting for.
We run npm install with the --ignore-scripts flag while the dust settles. Versions get pinned. For keyv that's 5.6.0. In every repo touched these days, .claude/ and .vscode/ get reviewed line by line. GitHub and npm tokens get rotated, not 'checked'. And one rule from now on: before 'trust' on a foreign project, you read exactly what's about to run.
Sources
Datadog Security Labs - Worm compromises hundreds of popular npm packages, 04.08.2026Snyk - Inside the keyv npm Supply Chain Compromise, 04.08.2026The visual is generated code-art, no third-party images.