On 4 August 2026, a self-propagating worm called ChainDrop — a variant of the Shai-Hulud family — entered the npm ecosystem. Through a compromised GitHub maintainer account for the keyv ecosystem, the attacker injected malicious code into the source, and the project’s own GitHub Actions release pipeline built and published poisoned versions of keyv, cacheable, flat-cache, file-entry-cache and more. The result: 444 infected packages collectively pulled roughly 2 billion times a month.
The mechanics are a modern supply-chain textbook: a malicious preinstall hook silently runs an obfuscated stealer that harvests npm, GitHub, cloud, Kubernetes, and Vault credentials, then reuses the stolen tokens to self-propagate across packages and repositories. Its C2 is anchored in an Ethereum smart contract: rotating a domain is a single blockchain transaction, which makes domain blocklists useless.
Why this hits you specifically
You never chose to install ChainDrop — it arrives as a transitive dependency in an ordinary npm install, most dangerously on a CI runner with maximal privileges: access to secrets, cloud, and registries. One poisoned build becomes a leak of every CI token and a launchpad for further spread.
What to do
- Audit npm publishing and GitHub activity: unexpected releases, new tokens, Actions changes.
- Rotate credentials — npm, GitHub, cloud, SSH and automation — treat them as potentially exposed.
- Disable install scripts (
npm config set ignore-scripts true), pin versions and lockfiles, verify provenance. - Isolate CI: ephemeral runners, least privilege, scope secrets to the step that needs them, filter egress.
To surface these risks, a secure code review, container security assessment, and cloud configuration review map your build-and-deploy exposure; an assumed-breach assessment shows the blast radius if a CI token leaked. Get in touch.
Sources: Unit 42, Zscaler ThreatLabz, Elastic Security Labs, StepSecurity analyses; CSA Singapore advisory; CSO Online, The Register.