An attacker compromised the GitHub account of the maintainer of the keyv npm library, releasing poisoned versions that carried a...

Source Brief

An attacker compromised the GitHub account of the maintainer of the keyv npm library, releasing poisoned versions that carried a credential-stealing worm. The supply chain attack affected millions of weekly downloads, highlighting vulnerabilities in open-source dependencies.