‼️A trusted dependency can become a supply-chain risk before there’s a CVE to track. Reports indicate the keyv npm package and related packages are being compromised with credential-stealing malware. If keyv is in your dependency tree: • check resolved versions • review lockfiles • monitor trusted advisories Verify against your actual installed versions. #SupplyChainSecurity