Free Business Plan Upgrades for Open Source Maintainers

Attackers compromised maintainer accounts for the widely-used 'keyv' and 'cacheable' npm packages by stealing authentication tokens, then pushed malicious code to downstream users. This is a classic supply chain attack: rather than targeting end users directly, adversaries exploit the trust placed in open source maintainers to distribute malware at scale. The incident underscores that open source maintainers — often volunteers with limited resources — are high-value targets whose credentials and tokens can propagate malware to thousands of dependent projects. Without robust token management, multi-factor authentication, and proactive dependency scanning, organizations consuming open source packages remain silently exposed.