The version that no longer exists
The public npm registry still records when keyv 6.0.0 was published — 2026-08-04 at 09:35 UTC — but the version itself is gone and the latest tag points back at 5.6.0. That is the ChainDrop supply-chain incident seen from the outside, in three queries anyone can run.
This package version was published on the fourth of August. It does not exist anymore.
A registry feels permanent. You pin a version, it stays there, and the thing you install tomorrow is the thing you installed today.
Ask the public registry when version six point zero of this package was published. It answers: the fourth of August, nine thirty-five in the morning.
Now ask whether that version still exists. False.
Then ask what the current release is. Five point six. The one from before.
Something was published, then pulled, and the tag was rolled back over it.
That is a supply chain incident seen from outside. A worm published bad versions of hundreds of packages that morning. If you installed during the window, you hold a copy the registry will no longer hand out.
Check your lockfile against what the registry still serves.
#linux#security#supplychain#infosec#sysadmin
❯ Check your lockfile against what the registry still serves.