00:00
2026-08-04
safedep.io
ai-tools
keyv 6.0.0 Compromised With an Install Hook and an IDE Auto-Run Hook
The npm package keyv published version 6.0.0 on 4 August 2026 with a preinstall script that executes an obfuscated dropper, compromising any developer who installed it directly or as a transitive depe…