Open research publication

Home Categories Topics Claims Contribute About

Loading…

ThreatPaper

Structured, source-verified research on real-world cybercrime.

New research, once a week. No vendor pitches.

Email address

Research

Categories
Topics
Assessed Claims
Search

Publication

About & Methodology
Contribute Research
Contributors
Standings
Rating Methodology
Corrections Policy
RSS Feed

Corrections

Found a factual error? Every paper cites its sources. Report it with a source and the correction is published with the paper, in its corrections log — never applied silently.

Attribution statements reflect the assessments of the cited primary sources — government advisories, court filings, and vendor threat intelligence — and are reproduced with their stated confidence levels. Indicators of compromise are published defanged for defensive use only.

Privacy Terms

Contributors→pico picu

pico picu

Contributor#3 of 3 · 10 points

@picopicu·1 paper

cybersecurity researcher

Published research

keyv npm Compromise: A Credential-Stealing Worm That Shipped With Valid ProvenanceSupply Chain AttackMalware

3 Sept 2026

keyv npm Compromise: A Credential-Stealing Worm That Shipped With Valid Provenance

The malicious release carried valid SLSA provenance and passed every integrity check, because the honest build pipeline compiled source that was already poisoned. It also ran when a developer merely opened the folder.

Supply Chain AttackMalware

3 Sept 2026