Contain a reported malicious keyv release

As of 2026-10-30, the available analysis consistently treats [email protected] as requiring immediate containment and the final synthesis identifies ChainDrop as a trust-compromise event in which valid provenance did not provide preventive assurance.

Waiting for a complete ChainDrop manifest would leave identified copies of keyv 6.0.0, exposed publishing credentials, and potentially compromised workflows in use.

The evidence supports quarantine and credential, workflow, dependency, and environment investigation now, while reserving definitive publishing-path attribution and wider package scope for direct records and an authoritative version-and-hash manifest.

Specific populations require different responses.

Maintainers and operators of [email protected], npm publishing identities, and the associated CI release workflow face possible credential and workflow-integrity exposure and should pause publishing and rotate exposed credentials.

Owners of applications or packages that directly or transitively resolved keyv 6.0.0 may have consumed the reported malicious artifact and should quarantine it and trace where it was installed.

Operators of developer systems, CI jobs, build environments, and deployments where [email protected] lifecycle scripts ran face possible execution and compromise; a lockfile or software-bill-of-materials match without installation does not establish execution.

Operators of package registries, mirrors, and caches holding keyv 6.0.0 should prevent quarantined copies from being reintroduced.

Consumers of other packages potentially involved in ChainDrop remain exposed to an unbounded scope because no authoritative package, version, and digest manifest is available.

Support — The 2026-10-30 supply-chain analysis cited reporting that [email protected] was associated with npm trusted publishing, provenance tag v6.0.0, commit f97eabcdd057105f1fce3f05d6c029dac3f2ac78, .github/workflows/release.yaml, and GitHub Actions run 30896232272. It shows why provenance can provide artifact and workflow lineage without proving that an artifact is benign.

Support — The packet’s detailed containment analysis recommends digest-based quarantine, suspension of the associated publishing relationship, revocation and rotation of maintainer and workflow credentials, dependency review, investigation of possible execution environments, and restoration through a clean reviewed workflow. The evidence audit found those actions consistently supported.

Support — The 2026-10-30 final synthesis states that ChainDrop demonstrates provenance remains useful forensic evidence but is not preventive assurance when trusted maintainers and workflows are compromised.

Evidence gap — The audit found no complete version-and-hash manifest for wider propagation and no preserved registry, workflow, or authoritative advisory evidence directly verifying the publishing-path details. Those gaps support qualified scope and attribution, not a broader definitive claim.

The supply-chain analyst surfaced reporting that [email protected] carried provenance tied to tag v6.0.0, commit f97eabcdd057105f1fce3f05d6c029dac3f2ac78, .github/workflows/release.yaml, and GitHub Actions run 30896232272.

The analyst concluded that provenance had retained useful lineage but had not prevented a reported compromise of trusted identities and workflow authorization. The decision scout translated that finding into containment actions.

The evidence auditors found strong support for quarantine, credential rotation, workflow review, dependency investigation, and controlled restoration, but identified two unresolved issues: no complete version-and-hash manifest and no preserved registry, workflow, or authoritative advisory records directly verifying the publishing-path account.

The boundary review therefore limited the conclusion to treating keyv 6.0.0 as potentially malicious and left wider ChainDrop propagation unbounded. A search found no prior Decision Record to update, and the arbiter selected a new operational containment decision with those qualifications.