Upwind First to Expose One of the Largest Open-Source Supply Chain Threats Targeting JavaScript
The software supply chain has become one of cybersecurity’s most attractive targets, largely because attackers no longer need to compromise thousands of organizations individually. Instead, infiltrating a single trusted dependency can create a ripple effect across countless development environments. That scenario played out this week when Upwind became the first to publicly report a malicious release of the widely used npm package Keyv, warning developers that the compromise had the potential to impact a massive portion of the JavaScript ecosystem.
The discovery centered on keyv@6.0.0, a malicious version of one of npm’s most heavily used packages. With approximately 154 million weekly downloads, Keyv serves as a core dependency for thousands of JavaScript applications, making any compromise particularly significant. Upwind’s findings prompted immediate guidance for organizations to remove the affected version and investigate whether sensitive credentials had been exposed.
A Malicious Update Hidden Inside a Trusted Package
According to Upwind, the compromised release introduced a previously unseen preinstall hook that executed automatically during installation. Rather than changing the package’s expected functionality, the attackers inserted an obfuscated loader designed to run before developers ever began using the library.
The loader downloaded the Bun runtime from GitHub Releases before launching a bundled payload capable of harvesting credentials from developer workstations and CI/CD environments. Among the targeted secrets were AWS credentials, GitHub tokens, npm authentication tokens, and HashiCorp Vault credentials, giving attackers a potential pathway into both development infrastructure and cloud environments.
“What makes this incident particularly significant is the package’s reach,” Upwind wrote in its public disclosure. “With approximately 154 million weekly downloads, keyv is a foundational dependency used across thousands of JavaScript projects, dramatically increasing the potential blast radius of the compromise.”
That reach transformed what could have been an isolated package compromise into an incident with ecosystem-wide implications.
The Attack Expanded Beyond Keyv
As researchers continued analyzing the incident, evidence emerged that the campaign had spread beyond the original Keyv release. Multiple malicious package versions were identified across the npm ecosystem, suggesting that stolen publishing credentials enabled attackers to distribute poisoned releases through additional packages.
Because package versions and “latest” tags changed rapidly as maintainers responded, security experts advised organizations to inspect their resolved dependency versions, lockfiles, and software bills of materials rather than relying solely on package registry listings.
The malware reportedly went well beyond credential theft. Analysis indicated it could collect authentication tokens, cloud credentials, private keys, and other sensitive information from developer machines and CI/CD runners. Some reports also described functionality capable of republishing compromised packages using stolen npm publishing access, increasing the possibility of automated propagation throughout the ecosystem.
Although the total number of affected packages continued evolving throughout the response, the campaign demonstrated how quickly attackers can leverage trusted software distribution channels once publisher credentials are compromised.
Trust Alone Is No Longer a Security Strategy
One of the more concerning aspects of the incident is that the compromised package reportedly passed through legitimate software release workflows.
Modern software supply chain protections, including provenance and build attestations, can verify how software is built, but they cannot always determine whether malicious code entered the development pipeline before those trusted processes began. As a result, organizations increasingly need visibility into dependency behavior—not just whether software was signed or built correctly.
The incident also reflects a broader shift in attacker strategy. Instead of focusing exclusively on exploiting deployed applications, threat actors are increasingly targeting developer tools, package managers, and build environments where a single successful compromise can reach thousands of downstream users.
A Reminder That Popular Packages Are Valuable Targets
For organizations using Keyv, Upwind urged immediate action: remove keyv@6.0.0, pin dependencies to a verified clean version, rotate credentials if the malicious release was installed, and review CI/CD pipelines, lockfiles, and SBOMs for exposure.
“This incident is another reminder that highly trusted, high-volume dependencies remain prime targets for supply-chain attackers-and that a single malicious release can have ecosystem-wide consequences,” Upwind said.
The discovery serves as another reminder that software supply chain security extends beyond vulnerability management. Even trusted, widely adopted open-source components can become attack vectors when release pipelines or publisher credentials are compromised. By identifying the malicious Keyv release early, Upwind’s disclosure highlighted both the speed at which these campaigns can unfold and the importance of continuously monitoring the behavior of software dependencies, not just the software itself.