Upwind Flags Malicious Keyv npm Release

Upwind Security first reported that [email protected], an npm package with 154 million weekly downloads, contained a malicious preinstall script harvesting AWS credentials, GitHub tokens, npm auth tokens, and HashiCorp Vault secrets. The campaign expanded to 16 packages across two ecosystems, scoring 92 overall in Upwind's Combined Incident Report.