keyv@6.0.0 shipped valid npm provenance and a daemon that fires when you revoke

Aug 4, 2026: the keyv worm hit 12 unrelated orgs in 3h43m, and the poisoned builds carried valid GitHub Actions provenance. Why rotating credentials first is the thing that triggers the payload.