Security check: FSB is not affected by the Keyv npm attack

[LakshmanTurlapati]

Quick security update after today’s Keyv and Cacheable npm supply chain attack.

We checked all four FSB lockfiles against the currently confirmed poisoned package list. FSB does contain keyv, flat-cache, and file-entry-cache through the Angular showcase’s ESLint tooling, but they are older known good releases:

• keyv@4.5.4
• flat-cache@4.0.1
• file-entry-cache@8.0.0

The malicious releases were keyv@6.0.0, flat-cache@6.1.24, and file-entry-cache@11.1.6.

We also found no malicious install hooks, campaign files, persistence indicators, or suspicious workflow changes. The lockfile integrity values match the npm registry.

So the package names are at the party, but they did not eat the suspicious snacks.

FSB is not affected and no dependency change or secret rotation is needed for this incident. We will keep watching as the affected package list develops, because npm apparently enjoys surprise events.

Source: https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack