The Keyv npm package and eight related dependencies were compromised in an active supply chain attack on August 4, 2026. An attacker injected Mini Shai-Hulud malware into the packages after gaining unauthorized access to the maintainer's GitHub account.