> TritonInfoSec News
Home / Aug 05, 2026 / Story
0
#3 The Hacker News general August 04, 2026 at 13:30 UTC

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

By [email protected] (The Hacker News)

AI Summary

A credential-stealing npm worm originating in [email protected] spread to at least 868 packages across 353 package names by August 4, 2026, with SafeDep verifying 353 poisoned versions across 79 package names. The worm plants Claude Code and VS Code hooks as persistence mechanisms, targeting developer toolchains directly. This incident follows the broader ChainDrop campaign and signals an escalating wave of self-replicating supply-chain attacks on npm.

Read full article → https://thehackernews.com/2026/08/keyv-linked-npm-…

Relevance score: 90.0/100

# More from August 05

  1. 1
    Massive ChainDrop npm supply-chain attack infects hundreds of packages BleepingComputer
  2. 2
    Massive supply-chain attack compromises 440 packages under four hours CyberScoop
  3. 4
    New Pass-ta-key attacks let malware hijack Google-synced passkeys BleepingComputer
  4. 5
    Prolific ransomware group behind SonicWall zero-day attacks CyberScoop
  5. 6
    CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises The Hacker News
  6. 7
    Russian hackers hijack hotel Wi-Fi networks to spy on travelers, Microsoft says The Record
  7. 8
    OpenAI, Anthropic AI agents targeted real people and systems in cyber tests BleepingComputer
  8. 9
    US Water Cyberattacks Extend Beyond Minnesota to at Least 6 Other States SecurityWeek
  9. 10
    TP-Link patches Omada ZTP flaws allowing hackers to breach networks BleepingComputer