Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm, (Wed, Aug 5th)

A widespread npm supply-chain campaign (keyv/cacheable) published trojanized packages with a preinstall loader and IDE autostart hooks that harvest cloud and CI credentials, then use stolen npm tokens to worm into additional packages; the payload also installs a dead-man's switch that polls GitHub with the stolen token and executes an attacker-controlled handler if the token is revoked, so incident responders should isolate affected hosts and preserve evidence before revoking credentials.