The worm that started in keyv@6.0.0 on August 4 did not stop at credential theft. SafeDep researchers tracked it spreading beyond the Keyv and Cacheable namespaces into hundreds of downstream packages, and among the payloads it drops are hooks targeting Claude Code, the kind of local developer tooling that runs with the same file and shell access as the engineer who installed it. A worm that plants agent hooks is not stealing tokens anymore. It is trying to recruit the build machine.

The mechanism matters more than the package count. npm's dependency graph gives a single compromised maintainer credential a blast radius measured in transitive installs, and a hook aimed at an AI coding agent inherits whatever permissions that agent already has on the host, the same over-permissioning gap Anthropic's own incident disclosures flagged last month. The control that would have changed this outcome is dependency pinning with lockfile integrity checks enforced at CI, not after. Engineering teams running Claude Code or any agent with local execution rights should audit hook configurations against known-good hashes before the next `npm install`, not after the next disclosure.