Credit: Upwind
Upwind was the first to publicly report that [email protected], a widely used npm package with 154 million weekly downloads, contained a malicious preinstall script that harvested AWS credentials, GitHub tokens, and npm auth tokens. The attack bypassed legitimate build pipelines and software provenance checks. The campaign later expanded to hundreds of packages. Upwind advises organizations to remove the compromised version, rotate credentials, and audit lockfiles.
For years, software supply chain attacks focused on compromising widely used applications after they had already been deployed. Increasingly, however, attackers are shifting their attention further upstream, targeting the open-source packages developers rely on every day. The latest example arrived when Upwind became the first to identify and publicly report a malicious release of the widely used npm package Keyv, warning that the compromise had the potential to affect organizations far beyond a single project.
The discovery served as another reminder that popularity can be a liability in the open-source ecosystem. A package trusted by millions of developers can quickly become an efficient distribution channel for malware if attackers succeed in compromising even a single release.
On the surface, the release looked unremarkable. But Upwind’s investigation found that [email protected] contained a malicious preinstall script that executed automatically when the package was installed.
“Our analysis identified a malicious release of keyv@* that introduces a new preinstall hook, executing an obfuscated loader during installation,” Upwind wrote.
Instead of immediately installing the package, the loader first downloaded the Bun runtime from GitHub Releases before executing a bundled payload. According to Upwind, that payload attempted to harvest sensitive credentials from developer workstations and continuous integration environments, including AWS credentials, GitHub tokens, npm authentication tokens, and HashiCorp Vault secrets.
The attack was notable not because it exploited a software vulnerability, but because it abused the trust developers place in package managers and automated dependency updates.
Keyv is hardly a niche library. The package records roughly 154 million downloads each week, making it a common dependency across JavaScript applications ranging from startups to enterprise software.
“What makes this incident particularly significant is the package’s reach,” Upwind explained. “With approximately 154 million weekly downloads, keyv is a foundational dependency used across thousands of JavaScript projects, dramatically increasing the potential blast radius of the compromise.”
That scale helps explain why supply chain attacks have become increasingly attractive. Rather than targeting individual companies one at a time, attackers can compromise software that many organizations install automatically through existing development workflows.
Subsequent reporting indicated that the campaign expanded beyond the original Keyv release, with malicious versions appearing across numerous npm packages. As the situation evolved, package maintainers removed compromised releases and restored clean versions, making accurate exposure assessments dependent on reviewing lockfiles and resolved dependency versions rather than simply checking the latest package available in the registry.
The incident also highlights an important lesson for modern software development: trusted infrastructure does not necessarily guarantee trusted software.
Reports indicate the malicious package moved through legitimate release automation, complete with software provenance generated by established build pipelines. Those protections verified the integrity of the build process itself, but they could not determine whether malicious code had already entered the source before the build began.
For security teams, that distinction is becoming increasingly important. Traditional software supply chain protections help validate authenticity, but they are less effective at detecting malicious behavior embedded within legitimate releases.
As organizations continue to adopt open-source software at scale, security strategies increasingly need to include runtime visibility into dependency behavior, particularly during installation, when malicious lifecycle scripts may execute before an application is even launched.
Upwind advised organizations using Keyv to immediately remove [email protected], pin dependencies to a verified clean release, rotate credentials if the malicious package had been installed, and inspect CI/CD pipelines, lockfiles, and software bills of materials for signs of exposure.
“This incident is another reminder that highly trusted, high-volume dependencies remain prime targets for supply-chain attackers, and that a single malicious release can have ecosystem-wide consequences,” the company said.
As software supply chains become larger and more interconnected, attacks like the Keyv compromise are likely to become more common rather than less. The incident demonstrates that protecting modern applications requires monitoring not only the code organizations write themselves, but also the trusted components they inherit from the broader open-source ecosystem. By bringing the malicious release to light early, Upwind highlighted how quickly a routine package update can become a far-reaching security event, and why visibility into software dependencies is now as critical as visibility into production systems.
Get the most important tech news in your inbox each week.
Contributed article. Not produced by the TNW newsroom and does not reflect the editorial stance of TNW.