A self-propagating worm tore through the npm registry on August 4, 2026, poisoning hundreds of JavaScript packages in under four hours and putting an estimated 2 billion weekly installs at risk. Security researchers are calling it ChainDrop, the latest and most sophisticated strain in the Shai-Hulud family of npm supply chain worms that first surfaced in September 2025. Nineteen days after the attack, developers are still rotating tokens, and the incident has become the clearest evidence yet that open-source package registries remain the softest target in enterprise software.
The attack started with a single compromised GitHub account tied to keyv, a caching library used across thousands of Node.js applications. From there, ChainDrop used stolen npm publishing tokens to republish itself into package after package, each new host becoming a new source of infection. By the time defenders caught up, the worm had reached deep-infrastructure dependencies that most developers never think about, let alone audit.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: ChainDrop Hits npm on August 4
According to StepSecurity’s incident report, the attacker compromised the maintainer’s GitHub account behind keyv and the related cacheable namespace, then published [email protected] with a malicious install script. From that first tainted release at roughly 09:35 UTC, the worm needed less than four hours to spread through the dependency graph, checking every stolen npm token for publish access and republishing itself into any package it could reach.
StepSecurity’s count landed at 444 packages and 2,212 malicious versions. Microsoft’s security team published a technical breakdown the same day, describing the payload as a “Mini Shai-Hulud variant” delivered through a heavily obfuscated JavaScript loader. Within 48 hours, national cyber agencies and half a dozen security vendors had issued their own advisories, each with a slightly different tally of the damage. That disagreement is itself part of the story, and it says something about how hard it still is to measure the blast radius of a fast-moving open-source worm in real time.
The affected packages are not glamorous. keyv is a caching abstraction. flat-cache and file-entry-cache handle file-level caching for build tools. cacheable extends the same family. None of them ship a user interface or make headlines on their own. That is exactly why the attack worked: these are the boring, load-bearing dependencies that sit three or four layers deep in a typical package-lock.json, rarely reviewed and almost never pinned.
Inside the Timeline: How Fast a Modern npm Worm Actually Spreads
The speed of the propagation is what separates ChainDrop from a garden-variety malicious package. The table below reconstructs the public timeline from vendor reports and advisories published in the two weeks after the attack.
| Date (2026) | Event | Source |
|---|---|---|
| Aug 4, ~09:35 UTC | [email protected] published with malicious preinstall hook; worm begins propagating | ZeroHunt.ai |
| Aug 4, ~13:20 UTC | Propagation window closes after roughly four hours; 444 packages, 2,212 versions poisoned | StepSecurity |
| Aug 4 | Microsoft publishes technical anatomy of the “Mini Shai-Hulud” payload | Microsoft Security Blog |
| Aug 5 | Integrity360 threat advisory names Deliveroo, Ornikar, Picsart, Qlik and ServiceTitan among affected organizations | Integrity360 |
| Aug 5 | TechTimes reports new capabilities: AI-agent config file payloads, Ethereum-based command and control | TechTimes |
| Aug 6 | Singapore’s Cyber Security Agency issues a national advisory on the ongoing attack | CSA Singapore |
| Aug 6 | Elastic Security Labs publishes detection guidance under the name CHAINDROP | Elastic Security Labs |
| Aug 10 | Eon.io details theft of AWS, Kubernetes and HashiCorp Vault credentials from CI runners | Eon.io |
| Aug 15 | The Register covers the campaign’s ability to evade standard dependency scanners | The Register |
Four hours from first malicious publish to hundreds of poisoned packages is not an outlier for this threat family anymore, it is close to the norm. That compression of the attack window is the single biggest problem for defenders, because it leaves almost no time between automated detection and real-world exposure for any team that runs npm install on a schedule.
The Numbers Don’t Agree, and That’s the Real Story
Every vendor that analyzed ChainDrop arrived at a different scale of impact. That is not sloppy reporting, it reflects how differently each firm measures “affected”: some count unique package names, others count published versions, and others estimate downstream install volume through registry download statistics that update on different schedules.
| Source | Packages Cited | Versions Cited | Estimated Download Exposure |
|---|---|---|---|
| StepSecurity | 444 | 2,212 | ~2 billion weekly installs |
| Integrity360 | 452 | 2,251 | ~2 billion monthly downloads |
| Cyberpress (initial count) | 868 | 1,381 | 2+ billion monthly installs |
| CSA Singapore | Not specified | 1,300+ | 2 billion monthly downloads (combined) |
| Eon.io | 1,300+ | Not specified | Billions of combined monthly downloads |
Whichever count you trust, the order of magnitude is the same: a caching library most developers have never heard of touched somewhere between 400 and 1,300 downstream packages, and those packages collectively account for billions of monthly installs. keyv alone pulls roughly 600 million downloads a month, according to figures cited by ByteIota’s incident writeup, which puts a single compromised maintainer account at the center of one of the widest-reaching npm incidents on record.
How ChainDrop Actually Works
The mechanics matter because they explain why traditional dependency scanning missed it. ChainDrop’s poisoned packages shipped a preinstall lifecycle hook, typically written as a single line in package.json.
"scripts": {
"preinstall": "node setup.mjs"
}
That preinstall script runs automatically the moment a developer or a CI pipeline executes npm install, before any code review or test suite ever sees the package. According to Socket.dev’s analysis, setup.mjs downloads a standalone Bun JavaScript runtime and uses it to execute a second, heavily obfuscated stage that harvests every credential it can reach on the machine.
Credential Theft, Then Self-Replication
The credential list is broad. Socket.dev’s researchers found the payload targeting cloud instance metadata, AWS, GCP and Azure keys, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC tokens and npm publishing tokens. Eon.io’s follow-up analysis confirmed that stolen AWS, Kubernetes and Vault credentials were pulled directly from developer machines and CI runners that had processed a poisoned install.
Once the worm has a valid npm token, it checks that token’s write permissions and whether it can bypass two-factor authentication, then uses it to download, modify and republish any package the token controls, each new release carrying the same infection. That is the self-propagating part: the worm does not need a second human error, it manufactures its own new hosts automatically for as long as it can find write-capable tokens.
Three Capabilities No Earlier Shai-Hulud Wave Had
What pushes ChainDrop past its predecessors, according to TechTimes’ reporting, is three additions. First, executable payloads were hidden inside AI coding agent and IDE configuration files, a location no mainstream dependency scanner reads. Second, command-and-control traffic routed through an Ethereum smart contract instead of a hardcoded domain, which sidesteps conventional domain-blocklist defenses. Third, the malware included a token-revocation watcher designed to trigger attacker-controlled code the instant a defender attempts to rotate a compromised credential, turning routine incident response into an active trigger.
Which Companies and Projects Were Hit
Integrity360’s threat advisory names Deliveroo, Ornikar, OneReach, Picsart, Qlik and ServiceTitan among organizations exposed to the compromised dependency chain. StepSecurity separately references “more than a dozen victim organizations” without naming all of them, and Cyberchief puts the confirmed organizational count at nine. None of the vendor reports claim these companies suffered a full breach; exposure means their build pipelines or developer machines executed npm install against a poisoned version during the roughly four-hour propagation window, which is enough to trigger credential theft even without further compromise.
The core affected packages are worth naming individually because they illustrate how deep dependency chains have become. keyv, cacheable, flat-cache, file-entry-cache and cache-manager are not application code, they are the caching plumbing that sits underneath frameworks, build tools and logging libraries. A team that has never directly installed keyv can still be exposed through a build tool three dependencies removed.
Shai-Hulud’s Lineage: This Is Wave Five or Six, Not Wave One
ChainDrop did not appear out of nowhere. Eon.io describes it as “at least the fifth wave in the Shai-Hulud lineage since September 2025,” while TechTimes frames the August incident as the sixth major campaign in the same family. Between those two waves, ByteIota attributes a May 2026 campaign that hit TanStack, Mistral AI and OpenSearch packages to the same threat actor, suggesting a group that has spent nearly a year refining the same core playbook: compromise a maintainer account, poison a widely depended-upon package, and let stolen tokens do the rest of the propagation automatically.
What has changed across those waves is not the target selection so much as the sophistication of the payload. Early Shai-Hulud campaigns relied on more straightforward credential-stealing scripts. ChainDrop’s use of a downloaded Bun runtime, AI-agent-file hiding spots and blockchain-based command infrastructure marks a level of tooling investment that suggests this is a well-resourced, iterating operation rather than a one-off opportunistic hack.
npm and GitHub’s Response
Public reporting on the platform-level response is thinner than the technical breakdowns, but the consistent picture across CSA Singapore, Microsoft and Elastic Security Labs is that malicious versions were pulled from the registry once identified, compromised maintainer accounts were locked down, and security teams worked with npm and GitHub to revoke stolen tokens. None of the write-ups quote a formal npm press statement, which several researchers flagged as a gap, arguing that faster and more transparent registry-level disclosure would help downstream teams triage exposure windows more precisely.
The CSA Singapore advisory urged organizations to treat the incident as ongoing rather than closed, recommending immediate dependency audits and token rotation rather than waiting for a final all-clear. That framing matters. A worm that self-propagates through stolen tokens does not have a clean end date the way a single malicious package does, because any token compromised during the initial window can still be used to publish new poisoned versions well after the original packages are cleaned up.
Market Impact: Why 2 Billion Weekly Installs Change the Calculus
The scale here forces a reassessment of how enterprises budget for open-source risk. A caching library is not the kind of dependency that gets a dedicated security review in most organizations, yet ChainDrop demonstrated that compromising one can reach further than attacking a marquee framework directly, precisely because nobody is watching it. Security vendors that sell software composition analysis and dependency-scanning tools are likely to see this incident cited in sales conversations for months, since it is a concrete, recent example of exactly the blind spot those tools are built to close.
There is also a second-order effect on CI/CD vendors. Eon.io’s finding that ChainDrop harvested AWS, Kubernetes and HashiCorp Vault credentials directly from build runners puts pressure on platforms like GitHub Actions, CircleCI and GitLab CI to push customers toward short-lived OIDC tokens instead of long-lived static secrets, a shift that has been recommended for years but rarely enforced by default.
Competitive Landscape: Who’s Positioned to Catch the Next One
Several categories of tooling responded to ChainDrop in public, and their relative speed is a useful signal for buyers evaluating supply-chain security coverage.
- Behavioral scanners (Socket.dev, StepSecurity): Both published detailed technical breakdowns within days, reflecting tools built specifically to flag install-time script behavior rather than just known-CVE matching.
- Platform vendors (Microsoft): Published its analysis the same day as the attack, likely aided by Defender telemetry across enterprise endpoints and CI environments.
- SIEM and detection labs (Elastic Security Labs): Focused on detection rules and indicators of compromise rather than headline impact numbers, useful for SOC teams building alerts.
- National CERTs (CSA Singapore): Issued broad advisories aimed at organizational risk management rather than technical remediation detail.
The gap this incident exposes is that most mainstream dependency scanners are built around known-vulnerability databases and static metadata, not runtime behavior at install time. ChainDrop’s use of a downloaded Bun runtime and AI-agent config file payloads was specifically designed to slip past that category of tool, which is why the vendors that caught it fastest were the ones already focused on behavioral and lifecycle-hook analysis rather than CVE matching alone.
Historical Context: A Year of Escalating npm Attacks
npm has weathered supply-chain incidents before, but the frequency has clearly accelerated since late 2025. The original Shai-Hulud campaign in September 2025 established the credential-theft-and-republish pattern. A wave in May 2026 hit packages tied to TanStack, Mistral AI and OpenSearch. ChainDrop in August 2026 represents the most technically advanced iteration yet, with roughly one major campaign in this lineage surfacing every few months over the past year. That cadence puts pressure on the entire open-source maintenance model, where a huge share of foundational JavaScript infrastructure is maintained by small, often unpaid teams whose GitHub accounts are one phished credential away from becoming a distribution point for malware reaching billions of installs.
This isn’t unique to JavaScript. PyPI and RubyGems have both dealt with smaller-scale token-theft incidents in the past two years, but npm’s sheer install volume and its culture of deeply nested transitive dependencies make it the highest-leverage target for this style of attack. A single compromised maintainer with publish rights to a popular caching library can, in effect, reach more machines in four hours than most zero-day exploits reach in a month.
Developer Defense Checklist: What to Do Now
The mitigation guidance across CSA, Microsoft, Socket.dev and StepSecurity converges on a consistent set of actions for any team that ran npm install between August 4 and the date malicious versions were pulled.
- Rotate and revoke npm tokens, GitHub tokens, and cloud credentials (AWS, GCP, Azure) on any machine that installed a poisoned package version.
- Enforce mandatory two-factor authentication on all npm publishing accounts and eliminate any token capable of bypassing it.
- Scope npm tokens to individual packages rather than issuing broad, organization-wide publish access.
- Audit package-lock.json and pnpm-lock.yaml files for keyv, cacheable, flat-cache, file-entry-cache and cache-manager versions published around August 4, 2026.
- Scan for packages that introduce new preinstall or postinstall scripts, particularly ones that download an external runtime like Bun during install.
- Move CI/CD pipelines toward ephemeral runners and short-lived OIDC credentials instead of long-lived static secrets stored in environment variables.
- Restrict outbound network access from build environments so a compromised install script cannot freely exfiltrate stolen credentials.
None of these steps are exotic. What ChainDrop demonstrates is that the gap isn’t a lack of known best practices, it’s inconsistent enforcement of them across the thousands of small teams and CI pipelines that make up the real npm ecosystem.
Predictions: Where npm Supply Chain Security Goes From Here
Based on the trajectory of this incident and the four preceding waves in the same lineage, a few outcomes look likely over the next two to three quarters.
- npm will tighten publish-token defaults. Expect shorter default token lifetimes and stricter package-scoped permissions to become opt-out rather than opt-in, following pressure from this incident and its predecessors.
- Behavioral scanning becomes a baseline requirement, not a premium feature. Tools that flag anomalous lifecycle-hook behavior at install time, rather than relying solely on CVE databases, will move from specialist products into default CI/CD tooling.
- AI coding agents become a new attack surface conversation. ChainDrop’s use of AI-agent config files as a hiding spot will push IDE and agent vendors to add scanning for that file class specifically.
- Another Shai-Hulud-lineage wave is likely within two to three months. Given the pace of roughly one major campaign every few months since September 2025, a further iteration should be expected rather than treated as a surprise.
- Enterprise buyers will demand SBOM-level visibility into transitive dependencies. The fact that keyv sat three or four layers deep in many affected build chains will accelerate adoption of software bill of materials tooling that maps beyond direct dependencies.
Why This Keeps Happening: The Maintainer Problem
Every technical fix in the checklist above treats a symptom. The underlying issue is structural: a handful of unpaid or lightly resourced maintainers control publish access to packages that back billions of downloads, and their personal GitHub security posture becomes, by extension, the security posture of everyone downstream. npm and GitHub have both pushed 2FA requirements for high-download packages in recent years, yet ChainDrop still started with a single compromised maintainer account. That suggests the phishing or credential-theft vector used to get into the keyv maintainer’s account bypassed whatever protections were already in place, a detail that has not been fully disclosed in public reporting as of this writing.
Until registries can either fund stronger maintainer security tooling at scale or shift toward mandatory hardware-key-backed publishing for high-download packages, incidents like ChainDrop are a predictable, recurring cost of how the open-source ecosystem is currently structured rather than a one-off anomaly.
Frequently Asked Questions
What is ChainDrop?
ChainDrop is the name security researchers gave to a self-propagating npm supply chain worm discovered on August 4, 2026. It is part of the Shai-Hulud family of attacks, and it spread by stealing npm publishing tokens and using them to automatically republish itself into new packages.
How many npm packages were affected by ChainDrop?
Estimates vary by source. StepSecurity counted 444 packages and 2,212 versions, Integrity360 cited 452 packages and 2,251 versions, and other vendors put the figure as high as 1,300 versions or more. The affected packages collectively account for an estimated 2 billion weekly to monthly installs.
Was I affected if I use keyv or flat-cache?
You may have been exposed if you ran npm install against a poisoned version published on August 4, 2026, even if you did not install keyv directly, since many affected packages were transitive dependencies. Check your lockfile for versions published on that date and rotate any credentials accessible from the affected machine.
What credentials does ChainDrop steal?
According to Socket.dev’s analysis, the payload targets npm publishing tokens, GitHub Actions OIDC tokens, cloud provider keys (AWS, GCP, Azure), HashiCorp Vault tokens, Kubernetes service account tokens, and cloud instance metadata accessible from the infected machine.
Is ChainDrop the same as the original Shai-Hulud worm?
No. ChainDrop is described by researchers as at least the fifth or sixth wave in the Shai-Hulud lineage since the original campaign in September 2025. It shares the core credential-theft-and-republish technique but adds new capabilities, including payloads hidden in AI coding agent configuration files and command-and-control routed through an Ethereum smart contract.
Has npm assigned a CVE number to ChainDrop?
No CVE has been publicly assigned specifically to ChainDrop. It is tracked as a campaign under the names Shai-Hulud, ChainDrop, and Mini Shai-Hulud rather than as a single discrete vulnerability, since it involves stolen credentials and abused lifecycle hooks rather than a flaw in npm’s core software.
How can developers protect against future npm supply chain worms?
Scope npm tokens to individual packages, enforce two-factor authentication without bypass options, audit lockfiles for suspicious lifecycle hooks like preinstall scripts that download external runtimes, use ephemeral CI/CD runners with short-lived OIDC credentials, and restrict outbound network access from build environments.
Will another Shai-Hulud-style attack happen again?
Given the pace of roughly one major campaign in this lineage every few months since September 2025, security researchers expect further waves. The trend has been toward greater sophistication with each iteration rather than a decline in frequency.
Related Coverage
- Windows Zero-Day Hits Patch Tuesday: 421 CVEs Fixed [2026]
- Data Breaches Top 471M Victims in H1 2026 [2026]
- How to Set Up HashiCorp Vault: 13 Steps, 100 Min [2026]
- Vulnerability Management Program: 12 Steps, 90 Min [2026]
- CyberArk vs BeyondTrust vs Delinea: PAM After the $25B Deal [2026]
- Wazuh vs Elastic vs Graylog: Free SIEM Saves 78% [2026]
For more on emerging threats and defensive strategy, see our cybersecurity threats hub.
