Keyv and friends compromised in active Shai-Hulud supply chain attack

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account