TL;DRUpwind was the first to publicly report that [email protected], a widely used npm package with 154 million weekly downloads, contained a malicious preinstall script that harvested AWS credentials, GitHub tokens, and npm auth tokens. The attack bypassed legitimate build pipelines and software provenance checks. The campaign later expanded to hundreds of packages. Upwind advises organizations to remove the compromised version, rotate credentials, and audit lockfiles.
For years, software supply chain attacks focused on compromising widely used applications after they had already been deployed. Increasingly, however, attackers are shifting their attention further upstream, targeting the open-source packages developers rely on every day. The latest example arrived when Upwind became the first to identify and publicly report a malicious release of the widely used npm package Keyv, warning that the compromise had the potential to affect organizations far beyond a single project.
The discovery served as another reminder that popularity can be a liability in the open-source ecosystem. A package trusted by millions of developers can quickly become an efficient distribution channel for malware if attackers succeed in compromising even a single release.
