The Attack Did Not Come Through the AI, but Through the Development Environment

At 9 a.m. UTC on August 4, 2026, a worm began working its way through the npm registry. The entry point was the hijacked maintainer account of keyv — a key-value cache with 127 million downloads per week that hardly anyone installs deliberately and almost everyone installs along the way. Wiz Research discovered the attack; Aikido and Datadog, among others, confirmed it. The number of poisoned package versions is reported as anywhere from more than 400 to as many as 1,300; the addresses of the command servers were pulled from an Ethereum smart contract, which made the worm immune to domain takedowns.

More interesting than the reach is the loot. The code did not only look for cloud keys, registry tokens and wallets, but specifically for the configuration files of AI coding tools: Claude Code, Cursor, Gemini, OpenAI. That made the list of credential targets roughly 70 percent longer than its predecessor’s. What was attacked was not the model, but the place where the credentials for the model are kept. Anyone who thinks about AI security and thinks about prompts is protecting the wrong spot.

At a glance

• What happened: On August 4, 2026 an npm worm distributed malicious code through a package with 127 million weekly downloads and systematically searched for the configurations of AI coding tools.
• What follows: On August 3, 2026 the OWASP list for LLM applications moved “Excessive Agency” from rank 6 to rank 3. The risk is shifting from the wrong answer to the wrong action.
• The catch: The countermeasures cost almost nothing — pin the lockfile, turn install scripts off, keep secrets outside project folders. Which is precisely why they are skipped.

The summer the tool chain became the target

The incident does not stand alone. Within three months, a theory turned into documented practice:

Date	Event	Relevant figure
Jun 17, 2026	Hijacked developer account at the agent framework Mastra	140+ malicious packages in 19 minutes
Jul 29, 2026	IBM Cost of a Data Breach Report 2026, 604 organizations	one in four malicious breaches AI-enabled, 6 million US dollars on average
Aug 3, 2026	OWASP Top 10 for LLM Applications 2026	“Excessive Agency” from rank 6 to rank 3
Aug 4, 2026	npm worm via keyv	127 million downloads per week, more than 400 package versions

The Mastra case shows the speed. In 19 minutes there is no organizational response — whatever holds has to have been set up beforehand.

And the OWASP shift is more than list cosmetics: the ranking now rests on real incident data for the first time. Besides the rise of “Excessive Agency”, “Unbounded Consumption” moves from rank 10 to 6, and “System Prompt Leakage” becomes the broader category “Hidden Context Exposure”. Not law, but the yardstick that auditors and requirement specifications adopt. IBM supplies the cost side: 4.99 million US dollars average damage per breach, and AI-enabled incidents rose by 56 percent.

Where the secrets actually live

I work with these tools every day, so here is the unromantic inventory. The most valuable data on a developer machine does not sit in a database but in text files in the home directory — readable by any process running under the same user. Including an install script.

Location	What it holds	Why the worm looks for it
~/.npmrc	auth token for the package registry	lets an attacker publish in your name
~/.git-credentials, GitHub CLI	tokens with repository and workflow rights	private code, build pipelines
~/.ssh/id_*	private keys, often without a passphrase	direct server access
~/.aws/credentials, ~/.kube/config	cloud and cluster credentials	that is production, not a test environment
.env in the project folder	database, payment and mail credentials	sits in the working directory every script checks first
configurations of the AI tools	API keys, connected servers, event-driven commands	the new target of August 4

The last row is the interesting one: such configurations hold not only keys but, in some tools, entries that run commands on certain events — a place where an attacker rides along again at the next start.

Why npm ci --ignore-scripts is a sensible habit. npm install may resolve versions anew; npm ci stubbornly installs what the lockfile says — against a version published maliciously twenty minutes ago, that is the only barrier that works without anyone lifting a finger. The extra argument suppresses install scripts: the step in which a package may execute arbitrary code with your rights, before anyone has read it. The price is real — packages with native components need their build step and have to be cleared individually via npm rebuild. Whoever does not prepare for that will switch the habit off again at the first broken build.

Why credentials should not live in project folders. The project folder is the worst-protected place in the system: copied, zipped, mounted into containers, sent around — and it is the working directory that every install script and every AI agent checks first. A .env next to package.json is not a hiding place, it is a shelf; add to that the classic git add -A with an incomplete .gitignore. The alternative takes half an hour: secrets in a file outside any repository, readable only by your own user, loaded as an environment variable when the shell starts. Passing a secret as a command-line argument is the worst option — it ends up in the process list and the shell history.

Three objections worth hearing

First: this is not an AI problem, it is an old npm problem. Correct, and it defuses nothing. What changed is the value of the loot: a developer machine in 2022 held keys to systems that hand out data; one in 2026 additionally holds access to systems that act on their own.

Second: suppressed install scripts are not a shield. They prevent code execution at install time, not malicious code in a package you then import yourself. They take the most convenient path away from the attacker, not every path.

Third: the numbers are softer than they sound. The range from more than 400 to 1,300 package versions shows that nobody had the full picture during the incident. The 70 percent increase in credential targets is a vendor measurement. IBM’s report rests on self-reporting, and “AI-enabled” is a broad category that a better-worded phishing email also falls into. These figures are good for orders of magnitude, not for drama.

The band is the supply chain everyone watches. The one thread that breaks away does not end in the model but far below it, at a flat file — that is where the credentials were.

What this means for your company

Ask your service provider about the lockfile, not about the certificate. Whoever has custom software built inherits the contractor’s development environment. The questions are short and verifiable: a pinned lockfile? Two-factor protection on the publishing accounts? An inventory of third-party components? Who has access to your systems? That belongs in the contract, not in a conversation.

Treat unauthorized tools as a supply-chain risk. The debate about shadow AI in the company usually revolves around data leaving the building. August 4 adds a dimension: a self-installed tool brings its own dependencies, which your procurement has never seen. IBM puts the additional cost of such breaches at up to 670,000 US dollars.

Write down an agent’s rights before you grant any. That is the practical core of the OWASP shift: an agent running with its user’s full rights has exactly that user’s reach if things go wrong — and on a developer machine that reach is considerable. Which tools, which directories, which network destinations, which action requires confirmation: four questions for a governance framework for AI agents, before the first agent goes into production.

Conclusion

Technically there is nothing new about this: hijacked maintainer accounts, install scripts as the entry point, text files full of keys in the home directory. What is new is what the search is for. There is nothing to buy here and no reason to panic either, but a handful of habits that add up to about a day of setup: install deterministically, install scripts off by default, secrets outside project folders, short-lived tokens with narrow rights — the CISA and NSA guidance of May 1, 2026 asks for exactly that for agents — and a written answer to the question of what an agent may do on this machine.

If you want to know how your service provider’s development environment holds up against this grid, let’s talk. I assess such questions as a business lawyer and work with the tools in question myself every day.

FAQ

What happened in the npm attack of August 4, 2026?

Through the hijacked maintainer account of the package keyv — 127 million downloads per week — malicious code spread across npm package versions; the reach is reported as anywhere from more than 400 to as many as 1,300 versions. The notable part is the target: alongside cloud and registry credentials, the code specifically went after the configuration files of AI coding tools, among them Claude Code, Cursor, Gemini and OpenAI.

Why is npm ci --ignore-scripts a sensible habit?

npm ci installs exactly the versions recorded in the lockfile instead of resolving them anew — a malicious version published minutes ago does not slip in unasked. The extra argument suppresses install scripts, the step in which a package may execute arbitrary code with your rights; that is precisely where credentials get harvested. The price: packages with native components have to be cleared individually. Protection against malicious code in a package you then import yourself, it is not.

What does the new OWASP list for LLM applications mean?

The OWASP GenAI Security Project updated its Top 10 for LLM Applications on August 3, 2026, drawing on real incident data for the first time. “Excessive Agency” — systems with more rights, tools and freedom to act than the task requires — rises from rank 6 to rank 3, “Unbounded Consumption” from rank 10 to 6. Prompt injection stays at rank 1. The risk is shifting from the wrong answer to the wrong action.

Does this also affect companies that do not develop software themselves?

Yes, through your service providers. Whoever has custom software built inherits the contractor’s development environment — in the worst case including their access to your systems. IBM’s Cost of a Data Breach Report 2026 puts a figure on it: 21 percent of the organizations surveyed had a security incident involving their own AI models or AI applications, up from 13 percent the year before. The right questions are quickly answered: a pinned lockfile, two-factor protection on the publishing accounts, separate credentials for development and production.

---

Sources — as of 15/08/2026

• Wiz Research on the keyv attack (primary analysis) — https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
• OWASP GenAI Security Project, Top 10 for LLM Applications 2026 — https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
• IBM, Cost of a Data Breach Report 2026 — https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
• CISA, NSA et al., Careful Adoption of Agentic AI Services — https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF
• Report on the Mastra incident of June 17, 2026 — https://tech-insider.org/npm-supply-chain-attack-2026/

On the sources: the reach of the worm is reported inconsistently (more than 400 versus up to 1,300 versions). The Mastra report is an aggregator, and the IBM figures rest on self-reporting.

This article is general information and not legal advice in an individual case. As of August 15, 2026; please check the current state before making decisions.