keyv npm supply chain attack hides malware in AI agent files scanners never read

A supply chain attack targeting the keyv package on the npm registry has been uncovered, with malware concealed in AI agent files that automated security scanners never read, Tech Times reports.

The attack exploits a specific blind spot: the malicious payload is placed in file types associated with AI agents that scanners routinely skip.

Because the malware lives outside the scope of typical scanning, the infection can spread through the dependency chain without triggering standard alerts.

The incident is the latest reminder that the JavaScript package ecosystem remains an attractive target for attackers seeking to compromise many projects at once through a single dependency.

AI agent files are a notable wrinkle: as AI coding assistants and agent tooling proliferate, attackers are adapting to hide code in the files those tools and their scanners overlook.

For teams that use keyv or depend on it transitively, auditing dependency trees and scanning the file types automated tools skip is a sensible first step.

What to watch next: whether the malicious versions have been removed from the registry, how many downstream projects are affected, and whether scanner vendors extend coverage to AI agent file types.