A recently discovered npm worm has infiltrated hundreds of software packages, originating from [email protected] and spreading across various namespaces. This malicious activity was first observed on August 4, 2026, impacting multiple organizations and posing significant security risks.
Widespread Impact and Initial Findings
SafeDep identified 353 compromised versions among 79 package names within the npm registry. Their monitoring indicated a broader impact, with 442 versions across 353 names affected. Aikido later reported an even larger footprint, with at least 868 packages involved across 1,381 versions. However, these broader numbers could not be independently verified from public lists by the reporting deadline.
The worm utilizes a preinstall script to execute a credential-stealing bundle in developer environments, capable of extracting repository and package registry credentials. This allows the worm to propagate by exploiting npm publishing access to infect additional packages.
Technical Mechanisms and Propagation
The Keyv repository also carries hooks for Claude Code and Visual Studio Code (VS Code), which can trigger the malicious payload under certain conditions. According to Socket, any environment running an affected version should be treated as compromised, with organizations advised to remove the malware’s credential-revocation watcher before rotating exposed tokens.
Security measures in npm 12, which block unapproved dependency lifecycle scripts, offer some protection. However, earlier npm versions remain vulnerable, allowing lifecycle scripts to be executed unnoticed.
Analysis and Consequences
The initial malicious release, [email protected], introduced a preinstall command and included additional files for malicious purposes. The stage one payload specifically checks for Bun and downloads a specific version from GitHub if necessary, executing a large compiled bundle to harvest sensitive information.
SafeDep’s analysis of the payload reveals its capability to extract data from GitHub, npm, cloud services, and other key infrastructures. The worm further includes code for modifying and republishing packages under stolen npm identities.
Security Recommendations and Future Outlook
The rapid changes in the registry complicate efforts to maintain a comprehensive list of affected packages. As such, security checks should rely on exact package names and specific resolved versions rather than cached tags.
Although not every package linked to the original maintainer was affected, the risk remains substantial. SafeDep recommends vigilance in monitoring for compromised credentials and emphasizes the importance of securing publishing accounts.
The connection between this attack and previous incidents, such as the April compromise of the lightning PyPI package, suggests a possible link within a broader malware family. However, the identity of those responsible remains unknown, highlighting the growing complexity and sophistication of modern cyber threats.
