Upwind flags malicious Keyv npm release

Upwind first reported malicious [email protected], an npm package with 154 million weekly downloads, containing a preinstall script that harvested AWS credentials, GitHub tokens, and npm auth tokens. The campaign expanded to hundreds of packages. Upwind advises removing the compromised version, rotating credentials, and auditing lockfiles.