Worm compromises hundreds of popular npm packages

On 2026-08-04 a widespread npm supply-chain campaign was observed that injected a two-stage loader into popular packages (including keyv, cacheable, and ecto) to execute a Bun-based second stage which harvests secrets (GitHub, npm, cloud, CI, Kubernetes, Vault, AWS), exfiltrates encrypted data using an Ethereum smart-contract dead-drop or GitHub repository fallback, and propagates by publishing malicious package updates and committing repository hooks and workflows.