npm overrides: Kill Bad Dependencies Fast

Keyv — a widely used npm key-value store — and several related packages were compromised today in what researchers are calling the "Shai-Hulud" supply chain attack. If any of these sit deep in your dependency tree, you need a fix now, not when every upstream maintainer publishes a patch.

Here's the catch: you probably don't import Keyv directly. Some caching utility three levels deep does. You can't just bump a version in your package.json. This is exactly what npm overrides was built for.

Why this matters

Modern JavaScript projects pull in hundreds of transitive dependencies. When one gets compromised, you're exposed even if you never typed import keyv. Waiting for every package author in the chain to update their dependency lists can take days — during which your app may be running malicious code.

How it works

Since npm 8.3, the overrides field in package.json forces any package — direct or transitive — to resolve to a version you specify. It replaces every instance in your dependency tree:

{
  "overrides": {
    "keyv": "^4.0.0"
  }
}

Every package that depends on keyv now gets that version, regardless of what they declared in their own package.json. Run npm install and your lockfile updates.

You can also scope an override to a specific parent:

{
  "overrides": {
    "some-cache-lib": {
      "keyv": "^4.0.0"
    }
  }
}

Where this helps

• Supply chain attacks — Pin a known-good version the moment news breaks, before upstream patches land.
• Transitive vulnerabilities — Force a patched version of a vulnerable dep that maintainers haven't updated yet.
• Breaking transitive updates — When a deep dependency ships a breaking change, roll it back across your entire tree from one file.

Watch out

Overrides are a sledgehammer. Forcing a version that's incompatible with what the parent expects will break things in confusing ways. Always run your full test suite after applying one.

Yarn uses resolutions. pnpm uses pnpm.overrides. Both have slightly different semantics — the overrides field is npm-only.

Overrides pin versions. They don't verify package integrity. Always pair them with a committed lockfile and npm ci in CI.

Try it yourself

Check whether Keyv or its companions are anywhere in your tree, then force a safe version:

# Find compromised packages in your dependency tree
npm ls keyv --all

# Force a known-good version across all deps
npm pkg set overrides.keyv="^4.0.0"

# Reinstall and verify the override took effect
npm install && npm ls keyv --all

TL;DR

• What happened: Keyv and related npm packages were compromised in an active supply chain attack today.
• Why it matters: npm overrides lets you force any version of any transitive dependency from package.json — no waiting for upstream patches.
• Try today: Run npm ls keyv --all on your projects. If it shows up, add an override before your next deploy.