This package has dated incident reports relevant to its trust history. Check the affected releases and the response before drawing conclusions about its current version.
Read the incident coverage →Loading historical repository activity…
Signals · last 2 checks
Dated reporting about this package. These events are separate from its current maintenance score.
· npm
Wiz documented malicious releases following a maintainer account compromise. The payload targeted developer and cloud credentials and attempted to spread through package publishing.
Affected versions: keyv 6.0.0; cacheable-request 13.0.20; cache-manager 7.2.10
Packages: keyv · cacheable-request · cache-manager
Source: Wiz Research
Third-party facts checked today; registry facts on every crawl.
| When | Change |
|---|---|
| 2026-09-05 | first verdict: active |
account hijacked 2026-08 6.0.0
The maintainer’s GitHub account was compromised and malicious commits to main triggered releases, with valid provenance, whose pre-install step stole npm, GitHub, cloud and Vault secrets and republished every package the stolen tokens could reach.
Commits deleted and versions removed; the worm reached over 2,200 versions across 444 packages.
Source: Aikido, Datadog Security Labs and Sonatype analyses, 4–5 August 2026. History, not a warning about today — the verdict above is about maintenance now.
Badge
Drop this in your README. It re-renders itself as the verdict changes.
[](https://isitdeadyet.dev/npm/keyv)Watch it
Get told when keyv changes state, changes licence, or is deprecated — instead of finding out during an incident.
Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.