- On August 4, 2026, a self-propagating worm named ChainDrop compromised over 400 npm packages, including keyv and flat-cache, within four hours.
- The attack used stolen GitHub credentials to publish malicious versions with valid provenance, making them indistinguishable from legitimate releases.
- The payload steals credentials, exfiltrates data via Ethereum-based C2, and republishes infected packages using stolen npm tokens.
- Organizations must check lockfiles, rotate credentials, and remove persistence mechanisms to mitigate the impact.
The npm ecosystem is reeling from one of the most aggressive supply chain attacks ever seen. On August 4, 2026, a worm dubbed ChainDrop tore through the registry, poisoning hundreds of packages in under four hours. The attack leveraged a compromised GitHub account to publish malicious versions of widely used libraries like keyv and flat-cache, which together account for hundreds of millions of weekly downloads. What makes this incident particularly alarming is that the malicious releases carried valid SLSA provenance, making them look completely legitimate to automated security checks.
Security researchers from StepSecurity, Unit 42, Sonatype, and Aikido have been racing to analyze the worm and contain its spread. The initial wave hit the jaredwray ecosystem, but the worm quickly expanded to other maintainers and organizations, including ServiceTitan, Qlik, and Deliveroo. As of the latest update, the number of compromised packages continues to climb, with new infections appearing every few minutes. This is not just another typo-squatting campaign; it’s a sophisticated, self-propagating worm that steals credentials and uses them to republish itself across the npm registry.
The Attack at a Glance
The attack began when the GitHub account of Jared Wray, maintainer of keyv and related packages, was compromised. The attacker pushed malicious commits directly to the main branch and cut new releases, which were then published to npm via the project’s own trusted publishing workflow. This meant the poisoned versions had valid SLSA provenance attestations, a feature that many teams rely on as a security signal. However, provenance only proves which commit was built, not whether the commit was authorized. The attacker also planted fake test files and modified release scripts to ensure the malicious versions became the latest dist-tag.
The malicious packages contained a preinstall script that executed a dropper called setup.mjs. This dropper downloaded the legitimate Bun JavaScript runtime from GitHub and used it to run a 727 KB obfuscated payload named Math_Symbol.js. The payload was a full-featured worm that harvested credentials from the victim’s system, including npm tokens, GitHub tokens, cloud credentials, SSH keys, and even AI tool configurations. It then exfiltrated the data to a command-and-control server, which was resolved via an Ethereum smart contract—a technique known as EtherHiding.
Affected Packages and Scope
The initial wave targeted 11 packages in the jaredwray ecosystem, including keyv@6.0.0, flat-cache@6.1.24, and file-entry-cache@11.1.6. These packages are transitive dependencies of countless projects, from ESLint to cache-manager. The worm then used stolen credentials to republish 433 additional packages, bringing the total to 444 packages and 2,212 versions within the first few hours. Later reports from Sonatype and Aikido suggest the number has grown even higher, with over 1,000 packages affected by the time the dust settled.
The second wave hit packages from organizations like @servicetitan, @qlik, @onereach, and @deliveroo, indicating that the worm had moved from public developer tools into corporate build pipelines. The attackers also created public repositories with Dune-themed names to stage exfiltrated data, and they planted persistence mechanisms in .vscode and .claude directories to re-infect developers who opened the compromised repositories.
How the ChainDrop Worm Works
The attack chain is a masterclass in living off the land. The preinstall script runs before any dependency is installed, so the worm executes with the user’s privileges. The dropper checks if Bun is already present; if not, it downloads a legitimate Bun binary from GitHub. This makes the network traffic look innocuous, as it’s coming from github.com. The second-stage payload then detaches itself as a background process and begins its dirty work.
One of the most distinctive techniques is runner memory scraping. The payload runs a Python helper that reads the memory of the GitHub Actions Runner.Worker process, searching for secrets injected into the workflow. This allows it to capture OIDC tokens and other ephemeral credentials that would otherwise vanish when the job ends. The worm also uses a Russian locale kill switch, exiting cleanly if the system language is Russian, a common tactic to avoid targeting CIS countries.
The payload includes a full npm publishing engine. It enumerates all packages the victim can publish, downloads the current tarball, injects the malicious preinstall script and payload, and republishes the package with a bumped version. It even generates its own Sigstore and SLSA provenance bundles, making the malicious versions look legitimately built. This self-propagation mechanism is what allowed the worm to spread so quickly across unrelated organizations.
Indicators of Compromise
If you installed any of the affected versions, assume your system is compromised. Look for these indicators:
- Files named setup.mjs, Math_Symbol.js, or math_init.js in node_modules directories.
- Unexpected Bun binaries on your system, especially if you never installed Bun.
- Modifications to .claude/settings.json or .vscode/tasks.json that reference setup.mjs.
- Outbound connections to npm-cache.com or awqhnjewqjkl.icu, or Ethereum RPC calls to contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103.
- New GitHub repositories with descriptions like “Shai-Hulud: Here We Go Again” or Dune-themed names.
Also check for the token monitor installed after exfiltration: ~/.local/bin/gh-token-monitor.sh, ~/.config/gh-token-monitor/, and systemd or LaunchAgent services. The worm installs this to punish credential rotation by triggering an attacker payload when the stolen token is revoked.
Mitigation and Recovery
If you’re affected, act fast. First, isolate the machine and preserve logs. Then, rotate all credentials that were present on the system, including npm tokens, GitHub PATs, cloud keys, and SSH keys. Remove the token monitor before rotating, as it will fire if you revoke the token. Next, clean your lockfiles and pin to known-good versions. For keyv, flat-cache, and file-entry-cache, use overrides to block the malicious versions. Finally, reinstall with –ignore-scripts to prevent any lingering install hooks from executing.
For CI/CD pipelines, review logs for any installs that resolved affected versions during the exposure window. Treat any runner that installed a poisoned package as compromised, and rotate all secrets available to that job. Also audit your GitHub organizations for unexpected workflows named “Run Copilot” or artifacts named “format-results”, which are signs of the worm’s secret laundering.
Defense in depth is crucial. Use egress allowlists on CI runners to block the dropper from fetching Bun. Implement cooldown policies that require packages to be a few days old before adoption. And don’t rely solely on provenance—it’s not a guarantee of safety. The best defense is to minimize the use of install scripts and to monitor for anomalous behavior.
As the investigation continues, the number of affected packages is still growing. The worm’s ability to rotate its C2 infrastructure via a single Ethereum transaction makes it particularly resilient. Security teams should monitor the smart contract for changes and stay updated on new indicators. The npm registry has begun removing malicious versions, but the cleanup is ongoing.
This incident is a stark reminder that the open-source ecosystem is only as secure as its weakest link. A single compromised maintainer account can cascade into a massive supply chain attack. The ChainDrop worm is a wake-up call for developers and organizations to adopt stronger security practices, including multi-factor authentication, least-privilege tokens, and continuous monitoring of dependencies.
