The Hacker News reports that a credential-stealing npm worm that began with keyv@6.0.0 spread into hundreds of package versions and planted hooks for Claude Code and VS Code while researchers tracked the open-source supply-chain compromise.
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
The Hacker News reports that a credential-stealing npm worm that began with keyv@6.0.0 spread into hundreds of package versions and planted hooks for Claude Code and VS Code while researchers tracked the open-source supply-chain compromise.
Source: Thehackernews