A self-propagating worm targeting the npm ecosystem has compromised hundreds of JavaScript packages, marking a significant escalation in software supply chain attacks. First identified in the widely used keyv caching library, the malicious code automatically replicated across multiple namespaces and organizations, while simultaneously embedding persistent backdoors directly into popular development environments like Visual Studio Code and Claude Code. The campaign, reported on August 4, 2026, represents a shift from isolated package compromises to automated, worm-like propagation that is substantially harder to contain.
Security researchers have been tracking the rapid expansion of the infection. Initial analysis by SafeDep confirmed 353 poisoned package versions across 79 distinct package names. As monitoring continued, the firm's telemetry expanded the scope to 442 compromised versions spanning 353 package names. Independent security vendor Aikido subsequently reported an even broader footprint, identifying at least 868 affected packages. The worm's architecture leverages the inherent trust developers place in common utility libraries, using each newly infected package as a distribution vector to automatically reach downstream projects.
What distinguishes this campaign from typical dependency poisoning is its sophisticated persistence strategy. Rather than relying solely on runtime credential harvesting, the malicious code actively modifies local development environments. It installs hooks within Visual Studio Code and AI-assisted coding platforms like Claude Code, granting attackers long-term, stealthy access to developer workstations. This mechanism allows threat actors to maintain a foothold even after the compromised npm packages are identified and removed from the registry, effectively turning everyday coding tools into surveillance and exfiltration endpoints.
The attack underscores a troubling evolution in open-source threat models. Historically, supply chain compromises required manual intervention or targeted social engineering. This incident demonstrates a fully automated approach that exploits the interconnected nature of modern dependency trees. By weaponizing a foundational utility like keyv, the operators bypassed traditional perimeter defenses, relying on the automatic installation behaviors of package managers to achieve scale.
For the broader IT and open-source community, the incident highlights the urgent need to rethink dependency management and local environment security. Development teams must now account for the possibility that compromised libraries can actively modify their toolchains, not just their application code. The immediate focus remains on patching affected packages and rotating exposed credentials, but the long-term implications point toward stricter runtime monitoring, enhanced IDE integrity checks, and more rigorous dependency auditing. The incident serves as a critical reminder that supply chain security extends far beyond the registry. Protecting modern workflows requires treating local development environments as critical infrastructure, implementing automated dependency scanning, and establishing rapid response protocols for toolchain-level compromises. As AI-assisted coding becomes standard, the attack surface will only expand, demanding a proactive shift in how organizations validate and isolate third-party code.
針對npm生態系統的自我傳播蠕蟲已入侵數百個JavaScript套件，標誌著軟件供應鏈攻擊的重大升級。最早在廣泛使用的keyv緩存庫中發現，惡意代碼自動跨多個命名空間與組織複製擴散，同時直接將持久性後門嵌入Visual Studio Code及Claude Code等熱門開發環境。此次於2026年8月4日通報的攻擊行動，代表著從單一套件投毒轉向自動化、蠕蟲式傳播的轉變，其擴散範圍更難以控制。
安全研究人員持續追蹤感染範圍的快速擴張。SafeDep的初步分析確認79個獨立套件名稱中存在353個受污染版本。隨著監測持續，該公司的遙測數據將範圍擴展至涵蓋353個套件名稱的442個受感染版本。獨立安全供應商Aikido隨後報告更廣泛的影響，識別出至少868個受影響套件。該蠕蟲架構利用開發者對常用實用庫的天然信任，將每個新感染套件作為分發載體，自動接觸下游項目。
與典型依賴項投毒不同之處，在於其精密的持久化策略。惡意代碼不僅僅依賴運行時憑證收集，更主動修改本地開發環境。它在Visual Studio Code及Claude Code等AI輔助編碼平台安裝鉤子程序，使攻擊者能長期、隱蔽地訪問開發者工作站。此機制讓威脅行為者即使在受感染npm套件被識別並從註冊中心移除後，仍能維持立足點，實際將日常編碼工具轉變為監控與數據外洩終端。
此次攻擊凸顯開源威脅模型令人擔憂的演進。過去供應鏈入侵需人工介入或針對性社會工程。本次事件展示完全自動化的方法，利用現代依賴樹的互聯特性。透過武器化keyv這類基礎實用庫，攻擊者繞過傳統邊界防禦，藉由套件管理器的自動安裝行為達成大規模擴散。
對更廣泛的IT與開源社區而言，事件凸顯重新思考依賴管理與本地環境安全的迫切性。開發團隊現在必須考慮受感染庫可能主動修改其工具鏈，而不僅是應用代碼的可能性。當前重點仍在修補受影響套件與更換洩露憑證，但長期影響指向需加強運行時監控、強化IDE完整性檢查，以及更嚴格的依賴審計。此事件關鍵提醒供應鏈安全遠超註冊中心範疇。保護現代工作流程需將本地開發環境視為關鍵基礎設施，實施自動化依賴掃描，並建立工具鏈級入侵的快速應變機制。隨著AI輔助編碼成為標準，攻擊面將持續擴大，要求組織在驗證與隔離第三方代碼方面採取主動轉變。