Critical

Keyv, cacheable npm supply chain attack hits 400-plus packages

SCM feed for Latest

August 4, 2026 at 4:54 PM

Actively Exploited

Overview

A recent supply chain attack known as Keyv has affected over 400 npm packages, potentially putting numerous developers and projects at risk. This attack is believed to be linked to a group or technique referred to as Mini Shai-Hulud. The compromised packages could allow attackers to inject malicious code into applications that rely on these libraries, creating vulnerabilities that could be exploited in various ways. As npm is a widely used package manager in the JavaScript ecosystem, the scale of this attack raises significant concerns for developers and companies that depend on these packages for their applications. The incident underscores the ongoing challenges in securing software supply chains and the need for vigilance among developers to ensure their dependencies are safe.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Over 400 npm packages
Action Required: Developers should audit their dependencies, remove affected packages, and apply any available security updates once identified.
Timeline: Newly disclosed

Original Article Summary

The attack is believed to be related to Mini Shai-Hulud.

Impact

Over 400 npm packages

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Developers should audit their dependencies, remove affected packages, and apply any available security updates once identified.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

Police arrests dozens of suspects in global cybercrime crackdown

BleepingComputer

In a significant global effort against cybercrime, law enforcement agencies from 22 countries collaborated to identify 263 suspects and arrest 58 individuals tied to criminal networks primarily based in Africa. This crackdown is part of a broader initiative to combat organized cybercrime, which has been a growing concern worldwide. The arrested suspects are believed to be involved in various cybercrimes, including fraud and identity theft, affecting numerous victims across different regions. By targeting these networks, authorities aim to disrupt the operations of these cybercriminals and protect potential victims from future attacks. This operation underscores the need for international collaboration in tackling cyber threats that span multiple borders.

Aug 25, 2026

Fake Minecraft Clients Deliver WeedHack Malware Despite Infrastructure Takedown

Infosecurity Magazine

Despite the takedown of its original infrastructure in July, the WeedHack malware continues to target Minecraft players through fake client downloads. This malware is particularly concerning as it can compromise user accounts and potentially lead to further security breaches. The ongoing distribution of WeedHack highlights the resilience of cybercriminals and their ability to adapt after losing access to their previous systems. Players who download these malicious clients are at risk, as the malware can steal sensitive information. This situation serves as a reminder for gamers to be cautious about where they download software and to be aware of the risks associated with unofficial game clients.

Aug 25, 2026

Unpatched Zimbra servers are falling to CVE-2026-73570 attacks

Help Net Security

At least 274 Zimbra servers have been compromised by attackers exploiting a vulnerability identified as CVE-2026-73570. This particular flaw is a code injection issue in the Zimbra Collaboration Suite (ZCS), which is widely used by organizations that prefer to manage their own data instead of relying on more expensive services like Microsoft 365 or Google Workspace. The vulnerability was patched by Synacor in version 10.1.20 of ZCS, released on July 20, 2026. However, many instances remain unpatched, leaving them vulnerable to exploitation. This incident highlights the risks associated with not keeping software updated, especially for platforms that handle sensitive communication and collaboration.

Aug 25, 2026

Silent Patches Don’t Stop Attackers—They Blind Defenders

SecurityWeek

The article discusses the issue of silent patches, which are updates made to software to fix vulnerabilities without publicly disclosing the details. While these patches can help secure systems, they also create a problem for defenders. Attackers can exploit these vulnerabilities without defenders knowing the full context of the risks they face. This lack of transparency can lead to misprioritization of security efforts, leaving organizations vulnerable. The piece emphasizes the need for better communication about vulnerabilities and updates to ensure that defenders have the information they need to protect against potential exploits.

Aug 25, 2026

ReliaQuest Rejects Compromise Claims After ShinyHunters Incident

Infosecurity Magazine

ReliaQuest has addressed a recent social engineering attack associated with the hacking group ShinyHunters. The company clarified that while there were attempts to compromise its systems, the attackers did not succeed in breaching their defenses. This incident serves as a reminder of the growing threat posed by social engineering tactics, where attackers manipulate individuals into divulging confidential information. Despite the denial of a successful compromise, the event raises concerns about the effectiveness of security measures and the importance of employee awareness training. Companies must remain vigilant against such tactics to protect sensitive data and maintain trust with their clients.

Aug 25, 2026

US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks

Infosecurity Magazine

The U.S. government has imposed sanctions on several individuals linked to the Mabna Institute, a hacking group based in Iran known for cyber-attacks. This group has been involved in various hacking activities, including stealing data from universities and businesses around the world. The sanctions target the group's members to disrupt their operations and deter similar actions in the future. By penalizing these individuals, the U.S. aims to hold them accountable for their cyber activities that threaten both national security and economic interests. This move also signals to other state-sponsored hacking groups that there are consequences for such cyber crimes.

Aug 25, 2026