AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

criticalnews

security

Source: The Hacker NewsAugust 4, 2026

Summary

A malicious npm package called keyv@6.0.0 spread to hundreds of packages in August 2026, using a preinstall script (code that runs automatically when a package is installed) to steal credentials like passwords and API keys from developer machines and CI environments (continuous integration systems that automatically test and deploy code). The worm could also plant hidden hooks in VS Code and Claude Code editors that execute the malicious code when a developer opens the project.

Solution / Mitigation

SafeDep advises responders to remove the malware's credential-revocation watcher before rotating exposed tokens and keys, since revocation is the watcher's trigger and rotating first can run an attacker-supplied local handler. Additionally, npm 12 blocks unapproved dependency lifecycle scripts by default, protecting users on that version going forward.