HomeAI · summaries
Storia in 2 fonti
Upwind first to report malicious Keyv release that threatened thousands of JavaScript projects
Upwind identified a malicious release of keyv@6.0.0 that harvested AWS, GitHub, and npm credentials via a hidden preinstall script. With 154 million weekly downloads, the compromise had ecosystem-wide blast radius.
Confronto fonti
2 prospettive sulla stessa storiaTimeline cronologica
- ·
thehackernews.com
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
A Keyv-linked npm worm poisoned 353 versions across 79 package names, stealing developer and CI credentials while repository hooks remained present.
- ·
thenextweb.com
Upwind first to report malicious Keyv release that threatened thousands of JavaScript projects
Upwind identified a malicious release of keyv@6.0.0 that harvested AWS, GitHub, and npm credentials via a hidden preinstall script. With 154 million weekly downloads, the…
