Supply chain attacks are back in the news, again
The Keyv and friends compromise surfaced today under the name 'Shai-Hulud supply chain attack.' Keyv is a widely used npm package for key-value storage with adapters for Redis, Postgres, SQLite, and others. The thread is short, but the attack is live and active.
This lands the same week as npm-scan appearing in the story list, which is positioned as 'modern supply chain security for the npm ecosystem.' These two things appearing together is not a coincidence, it is a symptom of an ecosystem under sustained pressure.
The broader pattern: npm supply chain attacks have been a recurring story for years and the response is always the same cycle of incident, post-mortem, new tooling, repeat. The Keyv attack is notable because Keyv is infrastructure-level, not application-level. It sits under a lot of other packages.
So what?
If you use Keyv in production, audit it now. More broadly, supply chain security for npm is not a 'nice to have' anymore. The frequency and sophistication of these attacks mean that not having a scanning step in your CI pipeline is a genuine risk exposure, not just a best practice gap.