Keyv npm Worm: Detection & Remediation for Supply Chain IDE Hooks

---
title: Potential npm Worm IDE Hook Installation
id: 8c4d2e10-1a5f-4c9e-9b0d-2f3e5a6b7c8d
status: experimental
description: Detects Node.js processes modifying VS Code or Claude Code configuration directories, a behavior associated with the Keyv-linked worm planting hooks.
references:
  - https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html
author: Security Arsenal
date: 2026/08/04
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
  selection_target:
    TargetFileName|contains:
      - '\.vscode'
      - '\claude'
  selection_file_ops:
    Operation|contains:
      - 'CreateFile'
      - 'WriteFile'
  condition: selection_parent and selection_target and selection_file_ops
falsepositives:
  - Legitimate developer extension installation via npm scripts (rare)
level: high
---
title: Suspicious Shell Spawn via NPM Postinstall
id: 9f5e3f21-2b6g-5d0f-0c1e-3g4f6b7c8d9e
status: experimental
description: Detects npm or node processes spawning shells (cmd/bash) which is common in malicious postinstall scripts like the Keyv worm.
references:
  - https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html
author: Security Arsenal
date: 2026/08/04
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\bash.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts requiring shell access
level: medium

// Hunt for Node.js processes modifying IDE directories
DeviceFileEvents
| where Timestamp > ago(3d)
| where InitiatingProcessFileName in ("node.exe", "npm.cmd", "node")
| where TargetFilePath has ".vscode" or TargetFilePath has "claude"
| where ActionType in ("FileCreated", "FileModified")
| project Timestamp, DeviceName, InitiatingProcessFileName, TargetFilePath, SHA256, AdditionalFields
| extend InstalledPackage = tostring(parse_(AdditionalFields).Package)

-- Hunt for recently modified VS Code hooks potentially planted by npm
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/*/.vscode/*")
-- Check if modified in the last 24 hours
WHERE Mtime > now() - 24H
  AND FullPath NOT IN ("/root/.vscode", "/home/*/.vscode/extensions")

-- Scan package. files for keyv@6.0.0 dependency
SELECT FullPath, Data.Version
FROM parse_(filename=FullPath)
WHERE FullPath =~ "package."
  AND Data.dependencies.keyv == "6.0.0"

#!/bin/bash
# Remediation script for Keyv-linked npm worm
# Checks for keyv@6.0.0 and suspicious postinstall scripts

echo "[*] Auditing node_modules for keyv@6.0.0..."

# Find all package. files recursively
find . -name "package." -type f | while read -r file; do
  # Check for keyv dependency at version 6.0.0
  if grep -q '"keyv"[[:space:]]*:[[:space:]]*"6.0.0"' "$file"; then
    echo "[!] MALICIOUS DEPENDENCY FOUND in: $file"
    echo "    Recommendation: Delete node_modules and package-lock., update keyv to a safe version."
  fi

done

echo "[*] Checking for suspicious postinstall scripts in node_modules..."

# Identify packages with postinstall scripts that reference IDE paths
find ./node_modules -name "package." -type f -exec grep -l 'postinstall' {} \; | while read -r file; do
  dir=$(dirname "$file")
  if grep -i 'postinstall' "$file" | grep -qiE '\.vscode|claude|hook'; then
    echo "[!] SUSPICIOUS POSTINSTALL SCRIPT FOUND in: $dir"
    cat "$file" | grep -A 5 'postinstall'
  fi
done

echo "[*] Audit complete."