I read the same npm attack in five countries' sources — I got five different stories

I followed the keyv compromise through US reporting, then went looking for the same incident family in Chinese, Russian, French and Israeli sources. What I found was not one story in five languages, but four different questions asked of the same facts.

Bu yazının Türkçesi: Türkçe sürüm.

Most of what I write sits on top of code a package manager downloaded. That is why supply chain attacks are not an industry topic: for anyone who types npm install, they are code that will execute on their own machine.

When keyv fell in August I read the coverage, checked my lockfiles, moved on. Then I noticed something about the coverage itself: every source I had read was a US security vendor's blog. So I went to find out how the same events were being written up in China, Russia, France and Israel.

I expected the same story in different languages. That is not what I found.

United States: a forensic timeline, to the hour

Wiz's keyv writeup reads like an incident log. 4 August 2026, 09:00 UTC: the attacker uses a compromised maintainer account to publish the poisoned release. 13:45: first findings go public. 15:00: researchers work out that the malware pulls its command-and-control domains from an Ethereum smart contract via eth_call. 19:50: full payload breakdown. Over 400 packages affected across the keyv/cacheable ecosystem.

The C2-over-smart-contract detail is the kind of thing this ecosystem is good at surfacing: you cannot take down a domain list that lives on a public blockchain.

But the part that changed my behaviour was the target list. The payload went after cloud credentials, developer credentials, crypto wallets, CI/CD secrets, /etc/shadow — and AI configuration files: Claude, OpenAI, Codex, Cursor, Gemini.

That list did not look like that a year ago. Attackers now know that a developer's machine holds agent credentials, and they are collecting them.

US sources are strongest on mechanism: how it got in, what it did, where it called home, which indicators to grep for. Their weakness follows from the same shape — when the incident closes, the writing closes with it.

China: not an incident, a systemic failure

For the earlier axios poisoning in the same family, the analysis on 安全内参 (31 March 2026) grabs the story from a different end. The technical account matches what you would read anywhere: axios@1.14.1 and axios@0.30.4 on the legacy branch, a fake dependency called plain-crypto-js@4.2.1, a postinstall script fetching a remote access trojan with separate macOS, Windows and Linux payloads, and a downloader that deletes itself when finished.

The emphasis is where it diverges. The piece foregrounds the attacker's planned 18-hour rollout across both branches and the use of anonymised ProtonMail accounts — it is measuring discipline, not just damage. Then it compresses the whole event into one claim: npm install equals arbitrary code execution. Not an accident, but the predictable output of single-point-of-failure risk in open source governance.

One more thing surprised me: the analysis is deliberately restrained about attribution. It lists four motive categories — financial, espionage, ransomware, APT — and refuses to pick one. No nation-state hint. I rarely see that much caution in the attribution section of an English-language vendor report.

Russia: supply chain as one line in a national threat report

In Russian sources the npm compromise is not a standalone story at all. In Positive Technologies' threat landscape roundup the npm incidents appear as entries inside a picture of who is attacking Russian organisations: June 2025, developer accounts taken over and the Scavenger stealer pushed through eslint-adjacent packages; September 2025, mass phishing leading to the compromise of debug, chalk and sixteen more libraries distributing a clipboard hijacker.

The report's actual subject is elsewhere: adversaries. It names Thor, PhantomCore, Fluffy Wolf and Cloud Atlas as the most active groups, and notes that Thor went from zero notifications in 2024 to 107 in 2025. It also reports that zero-day use has returned after several quiet years, citing Team46 exploiting a Chrome flaw and GOFFEE exploiting a WinRAR bug.

So the question is not "why is this ecosystem broken". It is "who is hitting us, and with what". The same events, filed under a completely different heading.

France: no narrative, just a table

CERT-FR's weekly bulletin of 31 August 2026 does not tell a story. It gives you a table: CVE, product, CVSS, class, and whether it is being exploited.

A table did in ten seconds what months of headlines had not. The moment one of those rows names a tool you actually run, the text stops being information and becomes a work order.

Israel: the attack surface itself changed

Israeli research approaches the same territory from an entirely different axis. On 6 August 2026 at Black Hat USA, Zenity Labs presented a class of zero-click attacks against agentic browsers — Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, Copilot Edge — where the attack can in some cases reach past the browser into local developer tooling and internal services (CTech's report).

I am putting that in a post about npm on purpose. The payload target list in the US analysis — the one harvesting Claude, Cursor and Codex configuration — and the surface in the Israeli research are the same surface. One says attackers are stealing agent credentials; the other says the agent itself can be turned against you. You do not draw that line without reading both.

Five sources, four questions

Here is what I was left holding:

None of these is more correct than the others. They describe the same reality and look different because they answer different questions. That is the real cost of a single-source diet: you are not being misinformed, you are only ever asking one question.

What it changed here

Finishing this, I noticed something uncomfortable: on a typical developer machine, the place that runs npm install is the place that holds the agent credentials. Those five lines in the payload list point exactly there.

Two rules came out of it, both free:

1. Agent credentials and package installation do not share a trust zone. If a dependency install can read my agent configuration, the blast radius of a supply chain compromise is wider than I had been assuming.
2. A CERT bulletin joined my weekly reading. News tells me what happened. A bulletin tells me what to do first. Those are not the same product, and I had been asking the wrong one.

The next post is about that second rule — why the bulletin format beats the news format for a one-person studio, and the US patching mandate that quietly changed this year.

← All posts