Hijacked keyv and cacheable npm packages in a supply chain attack

exploited in the wild · published 2026-08-04

Several keyv and cacheable npm packages were hijacked in an ongoing supply chain attack that Wiz Research is investigating; keyv 6.0.0 is a confirmed bad version.

Source: wiz.io

Get the fix

Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 1758 and your operating system.