#devops

The keyv npm Attack: Signed, Verified, and Malicious

The keyv and cacheable npm packages shipped a credential stealer with valid provenance. What it did, how to check if you're hit, and what to fix first.