GitHub Account Compromise Leads to Major npm Supply Chain Attack
On August 4, 2026, a significant security breach occurred when attackers compromised the GitHub account of the maintainer behind 'keyv', a key-value storage library with approximately 127 million weekly npm downloads. This breach allowed the attackers to inject credential-stealing malware across the entire package family, affecting other widely-used caching utilities such as 'cacheable', 'flat-cache', and 'file-entry-cache'. The attack was executed by pushing malicious files directly to the main branch and immediately releasing a new version, which was then published to npm with valid provenance signed by GitHub Actions. The malware, a heavily obfuscated JavaScript file, was designed to steal credentials from various secret stores on victim machines and exfiltrate them to a public GitHub repository. 
