Worm Infects Hundreds of npm Packages, Stealing Credentials and Planting VS Code Hooks
A sophisticated npm worm has compromised hundreds of packages, including those in the Keyv and Cacheable namespaces, spreading malicious code and implanting hooks for VS Code and potentially Claude.
A credential-stealing npm worm, first detected in keyv@6.0.0, has spread across hundreds of packages, impacting multiple organizations. Security researchers have identified a significant number of poisoned package versions, indicating a widespread supply-chain attack.
Initial reports from SafeDep documented 353 poisoned versions across 79 package names, while Aikido identified at least 868 packages across 1,381 versions. The malware utilizes a preinstall script to execute a credential-stealing bundle within developer and continuous integration (CI) environments. This bundle is capable of harvesting sensitive information, including repository, package registry, cloud, and private-key material, and then leverages available npm publishing access to further poison other packages.
Beyond credential theft, the compromised Keyv repository also contains hooks specifically designed for Claude Code and Visual Studio Code (VS Code). These hooks can execute the malicious payload once a user trusts the workspace or permits project configuration, posing a significant risk to development environments.
Security experts advise that any workstation or runner that executed an affected version should be considered credential-exposed. Responders are urged to remove the malware's credential-revocation watcher before rotating exposed tokens and keys, as rotating first could inadvertently trigger an attacker-supplied local handler. While npm version 12 blocks unapproved dependency lifecycle scripts by default, older npm clients and other installation methods that permit these scripts remain vulnerable.
The initial malicious release, keyv@6.0.0, introduced node setup.mjs as a preinstall command and included setup.mjs and Math_Symbol.js within the package. This stage checks for the Bun runtime, downloads a specific version if necessary, and then executes a compiled bundle that harvests various types of sensitive data, including GitHub, npm, cloud, Vault, Kubernetes, database, and private-key material. It also installs a token-revocation watcher and contains machinery for publishing packages under a compromised npm identity.
As the npm registry rapidly changed, with earlier versions being restored as 'latest' for some packages, determining a fixed campaign-wide list of compromised packages proved challenging. Exposure checks must rely on exact package names, resolved versions, and lockfiles rather than cached lists of current tags. The reported totals from SafeDep and Aikido reflect the number of malicious package artifacts, not necessarily the number of compromised systems.
A secondary execution path exists through the .claude/settings.json file, which contains a SessionStart hook calling .vscode/setup.mjs. Similarly, .vscode/tasks.json includes an Environment Setup task that runs on folder open, also calling .claude/setup.mjs. While these files enable payload execution from a checked-out repository, they do not run unconditionally in all default environments. VS Code prompts users before allowing automatic tasks in untrusted workspaces, and Claude Code applies workspace trust to repository-supplied settings.
Compounding the issue, the poisoned Keyv release passed through the project's legitimate GitHub Actions release workflow, resulting in valid OpenID Connect (OIDC) and SLSA provenance. This attestation correctly identified the build process but could not guarantee the safety of the source code entering it. The same payload and hooks have been observed in previous compromises, indicating a persistent threat actor or evolving attack techniques within the npm ecosystem.