REGULATIONNPM Worm Steals Credentials, Hits Claude Code HooksA compromised maintainer account let attackers plant a credential-stealing worm across the keyv, cacheable and related npm packages -- some with 500M+ monthly downloads -- hitting Claude Code and VS Code hooks.Aug 4, 2026