# Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks

DevFeed: [Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks](<https://devfeed.tech/articles/inside-the-keyv-npm-compromise-preinstall-malware-trusted-provenance-and-ide-hooks-7976.md>)

Original publisher: [Read original article](<https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/>)

Author: Liran Tal; Lion Kontorer

Published: 2026-08-04T04:00:00Z

Content type: news

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [ci](<https://devfeed.tech/tags/ci.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [code](<https://devfeed.tech/tags/code.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [embedded](<https://devfeed.tech/tags/embedded.md>), [enablement](<https://devfeed.tech/tags/enablement.md>), [ide](<https://devfeed.tech/tags/ide.md>), [incident](<https://devfeed.tech/tags/incident.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [malware](<https://devfeed.tech/tags/malware.md>), [manifest](<https://devfeed.tech/tags/manifest.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [payload](<https://devfeed.tech/tags/payload.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [releases](<https://devfeed.tech/tags/releases.md>), [research](<https://devfeed.tech/tags/research.md>), [scm](<https://devfeed.tech/tags/scm.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [security-labs](<https://devfeed.tech/tags/security-labs.md>), [snyk-learn](<https://devfeed.tech/tags/snyk-learn.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-security-intel](<https://devfeed.tech/tags/snyk-security-intel.md>), [software](<https://devfeed.tech/tags/software.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

Snyk reports an active supply-chain incident in which keyv 6.0.0 and ten related npm releases contained install-time malware. The article describes the malicious preinstall hook, its second-stage payload, affected-release investigation, and remediation guidance.

## Source excerpt

keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation order.