Post

🚨 Active npm supply chain attack: keyv@6.0.0 and 13 other packages have been compromised. keyv alone gets 154M weekly downloads. The worm steals cloud and CI credentials, then uses stolen npm tokens to publish trojanized versions of more packages.

Socket

@socket.dev

An added preinstall hook downloads Bun to execute an obfuscated payload that steals credentials. The attack also plants autostart hooks in .claude and .vscode that can run when a developer or AI coding agent opens the repo, with no npm install required. socket.dev/blog/popular...

4/8/26, 12:20 pm0 reposts5 likes

Vinkius

@vinkius-mcp-ai.bsky.social

7 Aug

You can use the Google Deps.dev Security Hacker MCP to audit open-source packages and hunt for these kinds of supply chain threats in dependency trees directly through your agent: https://vinkius.com/mcp/google-depsdev-security-hacker

vinkius.comGoogle Deps.dev Security Hacker MCP for AI Agents — SecurityLet your AI agents audit open-source packages and find hidden supply-chain threats with the Google Deps.dev Security Hacker MCP.