See the full list of npm packages compromised in the "Keyv / Cacheable Supply Chain Compromise - Aug 2026" [View compromised packages].
@reteps/dockerfmt
Bindings around the Golang `dockerfmt` tooling. It compiles the Go code to WebAssembly (using standard Go's `GOOS=js GOARCH=wasm` target), which is then used in the JS bindings.