Inside the keyv npm Supply Chain Compromise

Published: Aug 4, 2026 — Snyk Security Research

Attackers compromised the release path for keyv and related npm packages on August 4, 2026. Malicious releases add a preinstall hook that runs an obfuscated loader before application code starts, then launches a larger second-stage payload.

Independent tarball analysis

• Snyk downloaded and compared published tarballs without installing them
• Enumerated every package returned by npm for maintainer jaredwray
• Identified 11 malicious releases carrying the same two payload files (setup.mjs 29,918 bytes; Math_Symbol.js 727,680 bytes)
• At 11:16 UTC snapshot: eight of those releases still tagged latest
• @keyv scoped packages were not compromised in initial sweep
• [email protected] appeared after first public warnings with byte-identical payloads — early lists omitting ecto are incomplete
• npm later removed some versions ([email protected], [email protected], [email protected]) and retagged latest

Registry state changes quickly during active incidents; lockfiles and private mirrors remain investigation targets even after npm removes versions.