Anyone who builds sites or apps with Node.js.
The keyv npm worm
Poisoned versions of keyv and related npm packages steal developer passwords and keys, then spread by poisoning more packages.
If whoever builds your site installed a poisoned version, the passwords and keys on that machine may be in a stranger’s hands.
CSA counts over 1,300 package versions on npm.
No fix yet.
“Security researchers have identified an active software supply chain attack involving malicious versions of Keyv and related npm packages.”
Cyber Security Agency of Singapore, AD-2026-009
CSA says to remove the affected versions, rebuild any machine that installed one, and change the keys and passwords it held.