A new supply-chain attack is making waves across the JavaScript ecosystem, with a worm linked to the popular Keyv package poisoning hundreds of npm packages and planting malicious hooks into developer tools like Claude Code and VS Code. The campaign, disclosed by security researchers, marks one of the more aggressive and automated attacks seen in the open-source registry this year.

How the Keyv-Linked Worm Spreads

The worm operates by abusing the trust relationships within the npm ecosystem. Once it compromises a package—often through leaked credentials or typosquatting—it scans the package's dependencies and maintainer accounts to identify other packages that can be pushed to. This self-propagating behavior allows the worm to move laterally across the registry without requiring a single point of failure.

In this particular campaign, the attackers focused on packages that depend on or are related to Keyv, a widely used key-value storage abstraction library. By poisoning these packages, the worm was able to reach a broad swath of developers who might not directly use Keyv but rely on downstream dependencies that include it.

Infection Chain and Payload Delivery

  • Compromised packages are updated with malicious code that executes during installation.
  • The payload then modifies local configurations to install persistent hooks in Claude Code and VS Code.
  • These hooks can capture keystrokes, steal environment variables, or exfiltrate API keys and authentication tokens.
  • The worm also attempts to harvest npm tokens from the victim's machine to publish more malicious versions of other packages.

Malicious Hooks in Claude Code and VS Code

One of the most concerning aspects of this attack is the installation of hooks into developer tools. In VS Code, the payload adds tasks or user-level settings that execute when the editor starts or when a project is opened. In Claude Code, a terminal-based AI assistant tool, the worm inserts instructions that can exfiltrate conversation data or execute arbitrary commands.

These hooks are designed to be stealthy: they avoid printing output and often mimic legitimate configuration patterns. As a result, developers may not realize their environment has been altered until the damage is done—such as when private repositories are cloned, secrets are sent to remote servers, or malicious code is introduced into production builds.

Scale and Impact on the npm Ecosystem

The researchers tracking this worm report that hundreds of packages have been poisoned over a short period. The exact count is still evolving as the community and npm security teams work to purge the malicious versions. The worm's ability to spread via maintainer accounts means that even well-maintained packages are at risk if any associated account has weak or reused credentials.

For developers, the immediate risk is supply-chain compromise: installing a poisoned package can lead to credential theft, code injection, or further propagation of the worm through CI/CD pipelines. Organizations that rely on automated dependency updates are especially vulnerable because they may pull in a malicious version without manual review.

"This is a stark reminder that the open-source supply chain is only as strong as its weakest credential," noted one security analyst following the incident.

Recommended Mitigations

  • Audit your package-lock.json and yarn.lock files for any of the flagged packages and revert to known-good versions.
  • Enable two-factor authentication (2FA) on all npm accounts, especially those with publish rights.
  • Review your VS Code tasks.json and settings.json for unexpected entries, and check Claude Code configuration files for suspicious hooks.
  • Rotate any npm tokens, GitHub tokens, or cloud credentials that may have been exposed.
  • Use tools like npm audit and consider pinning exact versions of critical dependencies.

Key Takeaways

The Keyv-linked npm worm is a serious reminder of the evolving threat landscape in open-source software. Its ability to self-propagate and plant persistent hooks in developer tools makes it more dangerous than typical dependency confusion or typosquatting attacks. Developers and security teams should treat this as a wake-up call to harden their npm accounts, monitor their development environments for anomalies, and maintain a rigorous dependency review process.

While npm and the security community are actively responding, the full impact of this worm may not be known for weeks. Staying informed and applying the mitigations above can significantly reduce your exposure to this and similar future attacks.