Malicious code in @keyv/valkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77c74b9b7cab0e47c6f19a96a7ea44fd6d7c23989e4abdab3e708de9d6084d7f The package is a Keyv storage adapter for Valkey. No install-time lifecycle scripts, credential access, network exfiltration, dropper behavior,...

MAL-2026-12025 Malicious code in @keyv/valkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77c74b9b7cab0e47c6f19a96a7ea44fd6d7c23989e4abdab3e708de9d6084d7f The package is a Keyv storage adapter for Valkey. No install-time lifecycle scripts, credential access, network exfiltration, dropper behavior,...

MAL-2026-12019 Malicious code in @keyv/postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16a1c036c4437e534d6eca401133f16bd83f08e0ca4b656c8bef0906eaad2a5 @keyv/postgres is the PostgreSQL storage adapter for the keyv key-value store library. The package exposes a storage adapter API and does not exhibit...

Malicious code in @keyv/postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16a1c036c4437e534d6eca401133f16bd83f08e0ca4b656c8bef0906eaad2a5 @keyv/postgres is the PostgreSQL storage adapter for the keyv key-value store library. The package exposes a storage adapter API and does not exhibit...

MAL-2026-12013 Malicious code in @keyv/encrypt-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c28175ab56ea558a0634ba48421de59c05f3ebc5e06335162cd2d30a6972495 No static or traced-code signals of installer-side attack were observed in this version of @keyv/encrypt-node. No lifecycle-script fetch-and-execute,...

MAL-2026-12010 Malicious code in @keyv/compress-gzip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca4a62f75f4ef4696136cf194317102ad13aa319ba3319fb7dce12de6ae8e9d @keyv/compress-gzip is a gzip compression adapter for the keyv key-value storage library. No static or behavioral indicators of credential access,...

Malicious code in @keyv/compress-brotli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86bff1a8498159cc349a64d9d6459b842242e7d860aa2a33649708c9fc5f456a Package @keyv/[email protected] is a Brotli compression adapter for the keyv key-value store family. No credential access, network exfiltration,...

MAL-2026-12009 Malicious code in @keyv/compress-brotli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86bff1a8498159cc349a64d9d6459b842242e7d860aa2a33649708c9fc5f456a Package @keyv/[email protected] is a Brotli compression adapter for the keyv key-value store family. No credential access, network exfiltration,...

MAL-2026-12024 Malicious code in @keyv/test-suite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710c3cc7a3215d4a3bfa506c57bf04ffc7973d33da9dca652060a6bf1d0a4856 @keyv/test-suite is a shared test harness used by keyv storage adapter packages. No install-time lifecycle hooks, remote fetches, credential reads,...

Malicious code in @keyv/cloudflare-kv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b3d12d9e6fc46545510e3656381bca3029ff156434a34d54b21ed45d3c4145a @keyv/[email protected] is a Keyv storage adapter for Cloudflare KV. No install-time lifecycle hooks, credential-harvesting behavior, obfuscated...

Malicious code in @keyv/bigmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8f8e82f91c41a43a5730b8c4d545e0b2e7b8b43b0945d656f937ce6b4adf79 The package contents did not exhibit any behaviors associated with supply-chain attacks: no install/preinstall/postinstall lifecycle hooks fetching o...

ROOT-APP-NPM-CVE-2026-40181 CVE-2026-40181 in react-router - Patched by Root

Root has patched CVE-2026-40181 in the react-router package for Root:npm. Multiple fixed versions available...

MAL-2026-11970 Malicious code in file-entry-cache (npm)

npm/file-entry-cache version 11.1.6 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

Malicious code in cacheable (npm)

npm/cacheable version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

keyv and cacheable npm Package Hijacked in Supply Chain Attack

Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages...

Malicious code in keyv (npm)

npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

MAL-2026-11524 Malicious code in keyv (npm)

npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

Malicious code in exnesss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184796b4aafee8400786643e9f43338886de2166171c62879cfd4c023655b487 Package name 'exnesss' typosquats 'exness'. The package.json declares scripts.postinstall: 'node./postinstall.js', and postinstall.js issues an HTTPS...

MAL-2026-11518 Malicious code in exnesss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184796b4aafee8400786643e9f43338886de2166171c62879cfd4c023655b487 Package name 'exnesss' typosquats 'exness'. The package.json declares scripts.postinstall: 'node./postinstall.js', and postinstall.js issues an HTTPS...