According to CoinMeta, and as monitored by SlowMist, the Keyv ecosystem has suffered a large-scale npm supply chain attack. The attackers released over 2000 malicious package versions, including keyv.0.0. Keyv is a widely used key-value storage abstraction library that supports backends such as redis, sqlite, postgresql, and mongodb, with approximately 127 million downloads per week, resulting in significant exposure of the downstream supply chain. The attack methodology is highly similar to the shai-hulud and npm worm activities, indicating a highly automated and scalable supply chain attack. Potential attack behaviors include credential theft, environmental variable leakage, ci / cd key leakage, remote payload delivery, and lateral propagation through the compromised development environment.