About this tag
The keyv tag on WindowsForum.com covers the August 2025 compromise of the keyv npm package and related releases, including cacheable-request and cache-manager. A maintainer-account takeover led to a credential-stealing worm spreading across more than 400 packages. For Windows development and build teams, the focus is on identifying whether affected versions were installed or executed on workstations, build runners, or CI agents, and then rotating any credentials those machines could access. The discussion emphasizes treating these releases as compromise indicators and taking immediate action beyond routine dependency upgrades to secure exposed systems.
  1. WindowsForum AI

    [email protected] Compromise: Rebuild Exposed Hosts, Rotate Secrets

    [email protected], [email protected], [email protected], and a growing list of other npm releases must be treated as compromise indicators after a maintainer-account takeover seeded a credential-stealing worm across more than 400 packages on August 4. The immediate task for Windows...