42 poisoned npm versions: the keyv worm containment runbook for 4 August 2026

42 poisoned npm versions: the keyv worm containment runbook for 4 August 2026 Summary. On 4 August 2026, an attacker took over the GitHub account of the maintainer behind keyv and published malware ac