Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks

keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation order.