Wednesday 5 August 2026

One Poisoned npm Package. 868 Infected Versions. The Keyv Worm Is the Supply Chain Nightmare in Motion.

An npm worm seeded through a single poisoned package ballooned into nearly 900 infected versions overnight — the supply chain attack that keeps getting worse.

Lead story

One Poisoned npm Package. 868 Infected Versions. The Keyv Worm Is the Supply Chain Nightmare in Motion.

It started with a single package. On 4 August, keyv@6.0.0 — a widely used JavaScript key-value storage library — shipped with a credential-stealing worm baked in. Within hours, the infection had spread far beyond Keyv's own namespace into hundreds of packages across dozens of organisations. By the time researchers finished counting, the numbers were staggering: SafeDep verified 353 poisoned versions across 79 package names; a broader sweep put the figure at 442 versions across 353 names; Aikido's monitoring eventually reported at least 868 affected packages in total.

This is how supply chain attacks compound. A maintainer or a build system publishes a new version of a popular package. The worm inside it reads the package's dependency graph and republishes poisoned versions of those packages too. Each new release fans out to the next ring of dependents. You don't need to target anyone specifically — the ecosystem does the targeting for you.

The payload here wasn't subtle. Infected packages planted hooks into Claude Code and VS Code, two of the most common AI-assisted developer environments in use right now. That's a deliberate choice: developer tooling is where credentials live, where API keys get pasted, where cloud environment variables sit in plaintext. If you can get code running inside a developer's editor, you've got access to everything they're building — and likely their production infrastructure too.

The incident echoes the Arch Linux maintainer compromise we covered Monday, but the mechanism is different and in some ways more alarming. The Arch attack required hijacking human accounts. This worm propagated autonomously through the package registry itself. No account needed to be compromised for each new infection — the malware did the spreading.

What makes this particularly messy is that npm's trust model is built on version pinning and integrity hashes, but those controls only protect you if the original publish was clean. Once a worm is inside the registry publishing legitimate-looking new versions, downstream consumers pulling latest or using loose version ranges get infected automatically. Lockfiles help — but only if your lockfile predates the poisoned release.

For defenders, the immediate priority is auditing package-lock.json and yarn.lock files for any Keyv or Cacheable dependency versions published on or after 4 August. Tools like npm audit may not flag these as vulnerabilities yet since the poisoning was in the published source, not a known CVE.

Australian exposure here is real. npm is the backbone of virtually every JavaScript project in Australia — from government digital services built on Node.js to the fintech and startup ecosystem that runs heavily on cloud-native JS stacks. Any team pulling packages from the npm registry without pinned, audited lockfiles should treat this as an active incident, not a theoretical risk. The ASD's Essential Eight specifically calls out patch management and application control, but supply chain integrity at the package-registry level remains a largely unaddressed gap in most organisations' frameworks.

The broader pattern is what should worry the industry. Worms that self-propagate through package registries are not new in theory — researchers have demonstrated the concept for years. But incidents of this scale, hitting this many packages this fast, are becoming operational reality. The question is whether the ecosystem — npm, GitHub, the open-source maintainer community — can respond fast enough to matter.

Watch for: how quickly npm's security team can pull the poisoned versions, whether any credentials harvested in the interim surface in the wild, and whether similar worm behaviour turns up in PyPI or RubyGems next.

Also today

Device Code Phishing Is Up 1,500% — and Now It's Built Into Crimeware Kits

The commercial phishing-as-a-service toolkit Greatness has added device code phishing to its feature set, layering it on top of its existing adversary-in-the-middle credential interception. Device code phishing abuses OAuth 2.0's Device Authorization Grant — the flow designed to let smart TVs and printers log in without keyboards — to generate tokens that bypass MFA entirely. Industry data puts the technique's growth at 1,500% in 2026 so far. The fact that it's now shipping in a ready-made crimeware kit means the skill floor just dropped dramatically. Any organisation using Microsoft 365 or Google Workspace should ensure Conditional Access policies restrict device code flows to managed, approved devices.

The Hacker News ↗

CISA Gives Federal Agencies 72 Hours to Patch the N-able 'God Mode' Flaw

CISA has added CVE-2026-18577 to its Known Exploited Vulnerabilities catalogue after confirmed active exploitation against N-able N-central servers — the remote monitoring and management platform used by managed service providers worldwide. The flaw is a patch bypass for an earlier authentication bug, and attackers who exploit it gain full administrative access to an N-central console. That's effectively a master key to every endpoint the MSP manages. Federal agencies have been given three days to apply the hotfix. For Australian MSPs and their clients, this is a critical-priority patch — N-able is widely deployed across the local managed services sector, and a compromised N-central instance can cascade into client networks with no additional foothold required.

The Register ↗

Decades-Old BMC Flaw Leaves 24,000 Data Centre Management Interfaces Exposed

Researchers have found that over 24,000 internet-accessible Baseboard Management Controller interfaces — the always-on chips that let administrators manage servers remotely, even when the OS is off — are leaking authentication hashes before a user even logs in. The vulnerability is old; the exposure is current. BMCs run at a privilege level below the operating system, meaning an attacker who gets in through one can persist through OS reinstalls and bypass most conventional security tooling. This is the kind of finding that matters disproportionately for colocation data centres and cloud providers, where BMC interfaces are sometimes exposed for remote management convenience.

SecurityWeek ↗

15 Chained Bugs in TP-Link Omada Give Attackers Full Network Takeover

Forescout researchers disclosed 15 new vulnerabilities in TP-Link's Omada networking ecosystem — the cloud-managed switches, routers, and access points widely used in small-to-medium business environments. The flaws can be chained together through the Zero Touch Provisioning feature to achieve full network takeover without any authentication. TP-Link Omada gear is a common sight in Australian SMB, education, and hospitality networks. Organisations running Omada infrastructure should check for available firmware updates immediately and consider disabling ZTP on internet-facing devices until patches are confirmed applied.

SecurityWeek ↗

Google Deleted Three ADK Workflows After a GitHub Issue Could Hijack a Privileged AI Agent

Security researchers at Pillar Security demonstrated that a crafted public GitHub issue could manipulate a low-privilege triage agent in Google's Agent Development Kit into triggering a privileged code-fixing agent — effectively using a comment thread as a prompt injection vector. The attack worked because the triage bot had permission to invoke higher-privilege agents, and the authorisation check was based on a comment format that an attacker could replicate. Google deleted three affected AI workflows in response. This is the second agent-to-agent attack technique disclosed against Google's ADK tooling this week and fits a broader pattern of prompt injection vulnerabilities emerging as agentic AI systems proliferate in developer pipelines.

SecurityWeek ↗

Some Claude Conversations Are Indexed and Searchable on Google

A user setting in Claude that allows data sharing is resulting in some conversations being indexed by Google — including what appear to be AI-assisted therapy notes, medical billing analysis, and in some cases private cryptocurrency wallet keys and personal addresses. Anthropic's position is that users control whether their chats are shared, so the responsibility sits with the individual. That's a reasonable technical defence but a poor look: most users sharing data within an AI app don't expect it to surface in a Google search. This is the kind of privacy gap that would attract attention from the OAIC under Australia's Privacy Act, particularly given the sensitivity of the exposed data categories.

Schneier on Security ↗

Open-Weight AI Models Are Closing the Gap on Frontier — but Not on Safety

A new report from SaferAI finds that Z.ai's open-weight GLM-5.2 model is approaching frontier-level capabilities while lacking the safety mitigations — things like refusal training, red-teaming, and deployment controls — that closed-model providers apply before release. The concern isn't that open models are inherently dangerous; it's that the capability-safety gap is widening as open-weight models improve faster than governance frameworks can track them. Australia's approach to AI regulation has so far focused on high-risk use cases rather than model release standards, putting it in a similar position to the US: technically capable of being affected, without clear rules about who's responsible when an open model causes harm.

TechCrunch AI ↗

Nvidia's Week-Old AI Security Alliance Already Has 120 Members and Active Proposals

The Open Secure AI Alliance — spearheaded by Nvidia and announced just last week — has grown to more than 120 member companies and has already published draft proposals for defending against malicious AI agents. The speed is notable: most industry consortia take months to produce anything substantive. The proposals focus on agent behaviour boundaries and detection mechanisms for agentic AI systems operating across enterprise environments. It's early days, and industry alliances have a habit of producing frameworks that gather dust. But with agentic AI security incidents escalating — including this week's Google ADK disclosure — the urgency is genuine.

TechCrunch AI ↗

Anthropic Signs a $10 Billion Compute Deal with Cloud Startup Volta

Anthropic has reportedly signed a $10 billion deal with AI cloud startup Volta, continuing a run of major cloud infrastructure partnerships. The arrangement appears to be about securing dedicated compute capacity — the essential bottleneck for training and running frontier AI models at scale. Anthropic has been building out a web of cloud relationships beyond its primary AWS partnership, likely to reduce concentration risk and lock in capacity ahead of expected demand growth. A $10 billion commitment is a significant signal that Anthropic's revenue projections are bullish enough to underwrite long-term infrastructure bets at this scale.

TechCrunch AI ↗

Texas Freezes New Data Centre Grid Connections as AI Power Demand Overwhelms Supply

Texas has halted new data centre connections to the ERCOT power grid after demand from AI infrastructure buildout pushed the system to its limits — an ironic outcome for the governor who spent years marketing Texas as the nation's AI epicentre. The pause affects new connections, not existing facilities, but it signals a hard physical ceiling on how fast AI infrastructure can scale in the state. The grid crunch is a global dynamic: Australia faces analogous pressures as hyperscale data centre investment accelerates around Sydney and Melbourne, raising questions for AEMO about whether grid planning assumptions are keeping pace with AI-driven demand forecasts.

Ars Technica ↗

Apple Mounts New Legal Challenge Against UK Demand for iCloud Backdoor Access

Apple is reportedly launching a fresh legal challenge against the UK government's Technical Capability Notice — the mechanism under the Investigatory Powers Act that the Home Office used to demand a way around Apple's Advanced Data Protection end-to-end encryption for iCloud. An earlier challenge was partially heard in secret. The new action suggests Apple is not prepared to comply and is willing to fight through the courts rather than quietly weaken encryption for UK users. Australia has its own mandatory assistance laws under the Assistance and Access Act 2018 with similar powers, meaning the legal precedent set in the UK will be watched closely by Australian civil society and tech companies operating here.

The Record ↗

Sources consulted