NPM worm stole credentials, spread through legitimate security checks

An attacker on Tuesday compromised the GitHub account of the maintainer for keyv, a small key-value storage library used by npm approximately 127 million times weekly. Within hours, malicious versions of keyv and related caching packages were published to npm, containing a credential-stealing worm. Security firm Aikido identified at least 868 compromised packages across 1,381 versions, collectively downloaded over two billion times monthly.

The critical issue is not the download volume, but the method of distribution. The initial poisoned releases featured valid provenance signatures, the cryptographic attestation used to verify package origin. The worm did not forge this signature; it earned it through legitimate means.

This incident mirrors predictions made by CrowdStrike in a report published the day prior, which highlighted evolving software supply chain attacks targeting the developer ecosystem. The report specifically identified npm packages as a central point of risk. The keyv worm demonstrated this threat in real-time within 24 hours.

For security leaders, this event underscores that trust signals in the software supply chain can be subverted by account takeovers. The window between vulnerability disclosure and exploitation has shrunk significantly, outpacing traditional patching cycles.

The worm achieved legitimate provenance by being released through the maintainer's own GitHub Actions workflow, which automatically generated a valid signature. Some versions further leveraged these automated workflows to acquire tokens and create additional signing bundles from trusted contexts. The malware then spread rapidly through the complex web of package dependencies, impacting major organizations like Deliveroo and Qlik, whose developers had not directly installed the compromised library.