ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheable

Reported 05 Aug 2026 by otx · Severity: medium

Attackers compromised a GitHub maintainer account controlling keyv, cacheable, flat-cache, and file-entry-cache Node.js packages that collectively receive over a billion downloads monthly. Malicious code was pushed directly to the main branch and automatically published to npm wi