Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

The Hacker News 4 August 2026, 16:30 EEST AI

A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026. SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages…

Read the full story on The Hacker News https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html

AI tools reach the workflow of anyone running a website quickly, and most of them need a server that does not fall over at the first traffic spike. CrockyHost hosting scales without a migration.

Keep reading

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps The Hacker News
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets The Hacker News
AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files The Hacker News
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE The Hacker News