SlowMist: npm Supply Chain Under Massive Attack, Over 2000 Malicious Package Versions Published in Keyv Ecosystem

TechFlow news, August 05, according to monitoring by blockchain security company SlowMist (@SlowMist_Team), its threat intelligence system MistEye detected a large-scale npm supply chain attack targeting the Keyv/Cacheable ecosystem. The attackers published a total of over 2,000 malicious package versions, involving core components such as [email protected]. As a widely used key-value storage abstraction library, Keyv supports multiple backends including Redis, SQLite, PostgreSQL, and MongoDB, with weekly downloads reaching approximately 127 million, posing significant exposure risks to the downstream supply chain.

This attack method is highly similar to the previous Shai-Hulud npm worm activity, featuring characteristics of high automation and scalability. Potential risks include credential theft, environment variable leakage, CI/CD key leakage, remote payload delivery, and lateral movement, among others.

SlowMist recommends security teams immediately investigate and remove affected package versions, upgrade to verified secure versions, review dependency lock files and build logs, monitor suspicious outbound connections, rotate exposed credentials, and rebuild relevant environments from trusted sources if intrusion is suspected.