npm Supply Chain Worm Exploits Valid Provenance to Poison Two Billion Installs
The Development
An attacker who took over the GitHub account of keyv's maintainer — a key-value library downloaded 127 million times weekly — published poisoned releases in August 2026 that spread to at least 868 packages across 1,381 versions, collectively accounting for over two billion monthly installs. Aikido and JFrog independently traced the campaign; JFrog confirmed it reached more than 400 packages and 1,700 poisoned versions. The payload harvested cloud access keys, CI secrets, and npm publishing tokens, then used those tokens to backdoor additional packages. Confirmed corporate hits included packages under the Deliveroo, Qlik, and Picsart npm scopes — organizations that never directly installed keyv. The malware also planted persistence hooks inside Visual Studio Code and Claude Code working directories.
Our Take
The software supply chain security industry spent three years building provenance attestation as the answer to this problem. The keyv worm is a clean falsification of that thesis. Provenance proves a package came from the right pipeline; it proves nothing about whether the person who triggered that pipeline was authorised. CrowdStrike's finding that 88% of exploitation with a public proof-of-concept occurs within 48 hours of disclosure compounds the exposure — there is no patch cycle fast enough to absorb an attack that weaponises trust infrastructure itself. Enterprises that have accepted provenance attestation as a supply chain assurance need to recategorise it immediately: it is a necessary condition, not a sufficient one.
What Changed
Attackers can now earn cryptographically valid provenance attestations for malicious packages by controlling the maintainer account that triggers the trusted CI pipeline. Provenance no longer distinguishes legitimate releases from attacker-authored ones when identity is compromised — the entire basis of npm's supply chain integrity model collapses to a single credential.
Marketing Impact
Marketing technology and ecommerce engineering teams running Node.js-based build pipelines — which include virtually every modern martech stack — face direct exposure. Any CI runner that installs npm dependencies is a potential credential exfiltration point, putting campaign infrastructure, CRM integrations, and cloud environment access at risk.
Competitive Implication
Software vendors and SaaS providers dependent on open-source npm dependencies face emerging contractual liability as enterprises begin shifting supply chain security obligations downstream. Vendors with auditable identity governance and documented patch SLAs gain procurement advantage; those relying on provenance attestation alone become contractually vulnerable as enterprise procurement teams tighten supplier security requirements.
Strategic Outlook
GitHub's npm 12 default — disabling install-time scripts — blunts the execution vector for this specific worm but leaves the identity compromise path fully open. Expect accelerated enterprise adoption of min-release-age cooldowns and short-lived scoped publish tokens. Regulatory pressure for software bills of materials with identity provenance, not just build provenance, will intensify through 2027.
The Exploit
Action Item
DevSecOps and engineering leads should enable npm's min-release-age flag and enforce npm 12 or newer across all CI runners before the next sprint cycle — the configuration change is free, takes under a day to deploy, and directly blocks the execution path this worm used.