{
  "entry": {
    "kind": "vuln",
    "slug": "keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json",
    "name": "keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json",
    "vendor": "keyv and cacheable namespace releases published during the campaign",
    "description": "A self-propagating worm in the Shai-Hulud family compromised the keyv and cacheable npm namespaces and spread to more than 400 packages. Beyond harvesting AI tool credentials, the payload writes its own entries into the developer's .claude/settings.json as a SessionStart hook and into .vscode/tasks.json as a folderOpen task, so it re-executes the next time Claude Code starts or the folder is opened, surviving removal of the package that delivered it. Analyzed independently by Socket, Wiz, Aikido, JFrog and SafeDep.",
    "website": "https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-04",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json",
      "aliases": [
        "ti-065"
      ],
      "title": "keyv/cacheable npm Worm Writes Auto-Run Hooks Into .claude/settings.json",
      "summary": "A self-propagating worm in the Shai-Hulud family compromised the keyv and cacheable npm namespaces and spread to more than 400 packages. Beyond harvesting AI tool credentials, the payload writes its own entries into the developer's .claude/settings.json as a SessionStart hook and into .vscode/tasks.json as a folderOpen task, so it re-executes the next time Claude Code starts or the folder is opened, surviving removal of the package that delivered it. Analyzed independently by Socket, Wiz, Aikido, JFrog and SafeDep.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft",
        "Malware"
      ],
      "componentType": "agent",
      "component": {
        "name": "keyv and cacheable namespace releases published during the campaign",
        "vendor": null,
        "package": null,
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "keyv and cacheable namespace releases published during the campaign, plus 400+ downstream packages",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-08-04",
      "modifiedAt": "2026-08-04",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain"
        }
      ],
      "mitigation": "Audit .claude/settings.json and .vscode/tasks.json on every developer machine for hook and task entries nobody added, and treat any unexpected entry as active compromise rather than drift. Rotate AI tool credentials, npm tokens and cloud keys from affected machines. Removing the npm package alone does not remove persistence.",
      "detectedByAnomity": true
    }
  }
}