npm Ecosystem: ChainDrop Self Propagating Supply Chain Worm

Microsoft Threat Intelligence has confirmed a large scale supply chain attack against the npm registry, carried out by a self propagating credential stealing worm that researchers have named ChainDrop. Microsoft describes the malware as a "Mini Shai-Hulud variant" delivered through a heavily obfuscated Bun based JavaScript payload that executes automatically via an npm preinstall lifecycle hook. Package counts vary sharply by tracker: Microsoft puts it at "more than 400 packages across multiple unrelated publishers," StepSecurity counted 444 packages across 2,212 versions as of 18:10 UTC on August 4 (CSO Online), SafeDep later confirmed 2,234 poisoned versions across 444 package names and 12 unrelated organizations (Neuracyb Intel), and BleepingComputer reported "more than 1,300 packages with a combined 2 billion monthly downloads." Aikido's figure is itself reported two ways: BleepingComputer quotes "at least 868 packages (across 1381 versions)," while Neuracyb Intel cites Aikido at 434 packages and 1,381 versions. The version count of roughly 1,300 to 2,200 is the more consistently corroborated number; the package count is not settled.

What Happened

The campaign began on Tuesday, August 4, 2026, with the compromise of the GitHub account of the maintainer behind the keyv caching library. CSO Online names the maintainer as Jared Wray and places the first malicious release, keyv 6.0.0, at approximately 09:00 UTC. keyv alone draws over 150 million weekly downloads.

Rather than stealing a publishing token and uploading malware directly, the attacker pushed malicious files straight to the projects' main branches and immediately cut new releases. The maintainer's own GitHub Actions workflows then built and published the trojanized versions to npm. Because the builds ran through legitimate pipelines, the poisoned releases carried valid provenance attestations and digital signatures, a detail confirmed independently by BleepingComputer, Expel, Neuracyb Intel and The Next Web.

From that first account the infection spread to sibling packages under the same maintainer, including cacheable, flat-cache, file-entry-cache, cacheable-request, cache-manager and ecto. Within roughly two hours it had reached packages associated with unrelated corporate publishers. Named organizations across sources include Deliveroo, Ornikar, OneReach, Picsart, Qlik and ServiceTitan, with specific packages such as @deliveroo/reevent, @or-sdk/invitations, @picsart/ai-sdk, @qlik/embed-runtime and picasso.js. Neuracyb Intel reports researchers observed the worm republishing entire namespaces at roughly one release per second.

Aggregate exposure is consistently described in the billions. Multiple outlets cite more than 2 billion combined monthly downloads; SafeDep estimated keyv, flat-cache, file-entry-cache and cacheable-request alone at roughly 1.88 billion downloads per month. Expel's more conservative framing is "a combined billion plus downloads a month" for the initial cluster. Critically, several of these packages are pulled in transitively through tooling such as ESLint, meaning organizations may have installed malicious versions without ever declaring them as direct dependencies.

What Was Taken

The payload is a broad spectrum credential harvester rather than a targeted collector. Microsoft confirms it searches developer workstations and CI/CD environments for npm, GitHub, cloud and infrastructure credentials, then uses recovered identities to authenticate to npm, GitHub, AWS, Kubernetes and HashiCorp Vault in order to enumerate packages, repositories, workflow secrets, cloud parameters and secret store values.

Expel adds further collection detail, reporting that the payload dumps GitHub Actions runner memory to capture ephemeral publishing tokens, parses local npm and GitHub config files, and crawls local disks for SSH keys, .env files, database connection strings and API keys for services including Slack and Stripe. The Next Web similarly describes SSH and private keys plus database and Slack credentials in scope. Treat the disk crawling and runner memory specifics as vendor reporting rather than Microsoft confirmed.

Exfiltration channels differ between accounts and this matters for hunting. Microsoft states that collected data is encrypted and sent to an attacker controlled HTTPS endpoint, with GitHub repositories as a fallback channel. Expel reports exfiltration to attacker controlled GitHub repositories and Ethereum smart contracts. CSO Online reports that the campaign was named ChainDrop specifically because this variant uses the Ethereum blockchain for command and control, a technique known as EtherHiding. The most defensible reading is that HTTPS is the primary channel per the vendor with direct malware analysis, with GitHub and blockchain based paths providing resilient fallback and C2.

No source in this set quantifies how many credentials were actually stolen, and no victim organization has published a confirmed count of compromised secrets.

Why It Matters

ChainDrop breaks the assumption that provenance attestation equates to trustworthiness. Every poisoned release was built and signed by the genuine project pipeline from the genuine repository. As StepSecurity put it, quoted by The Next Web: "Provenance proves which commit was built, but it cannot prove the commit was authorised." Any tool configured to gate installs on valid provenance passed these packages through without objection.

The second structural problem is autonomy. Microsoft identifies automated propagation as the payload's most significant capability: after obtaining an npm publishing token, the malware enumerates packages available to the compromised identity, downloads their latest tarballs, injects the malware and setup loader, adds a preinstall hook, increments the patch version and republishes. There is no operator in the loop. One compromised build environment becomes the launch point for the next, which is why counts were still climbing while defenders were mid investigation.

Third, Microsoft documents an emerging vector with no clean precedent: the malware can use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer to developer infection path. Compromise of AI assistant and editor configuration is not something most software composition analysis tooling inspects.

Finally, this is a continuation, not a novelty. Shai-Hulud has plagued npm and PyPI since 2025 across multiple variants. ChainDrop is the largest and most capable wave to date, and the pattern of maintainer account compromise feeding automated release pipelines is now proven at scale.

The Attack Technique

Initial access was account level, not registry level: the attacker took control of a single maintainer's GitHub environment and abused the trust already granted to it. Every poisoned package carries the same three part signature, consistent across BleepingComputer, Expel and StepSecurity reporting:

• A "preinstall": "node setup.mjs" entry added to package.json
• setup.mjs, a dropper that downloads the legitimate Bun JavaScript runtime from its official GitHub release
• Math_Symbol.js, the obfuscated second stage executed by that Bun binary, described by StepSecurity as roughly 710KB

The Bun download is an evasion choice, not a convenience. Fetching a signed, legitimate runtime from github.com means every network request during the infection chain points at infrastructure that security tooling already trusts, as The Next Web notes. BleepingComputer reports that setup.mjs deletes traces after executing the payload. Because the hook is preinstall, execution happens automatically before npm install completes, with no build step, import or application run required.

Propagation then closes the loop through stolen npm tokens, republishing modified tarballs as patch version bumps under whatever identities the worm has captured.

Indicators and Affected Packages

Confirmed compromised versions reported by Neuracyb Intel include keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable-request 13.0.20, cacheable 2.5.1, @cacheable/memory 2.2.1, cache-manager 7.2.10, @cacheable/node-cache 3.1.2 and @cacheable/utils 2.5.1. This list is not exhaustive and reflects only the first cluster; the full affected set spans hundreds of names across at least a dozen publishers and continued expanding through August 4. Microsoft has published indicators of compromise alongside its analysis and that should be treated as the authoritative reference set.

File level indicators to hunt for are the presence of setup.mjs and Math_Symbol.js in installed package directories, and any preinstall script invoking node setup.mjs.

What Organizations Should Do

1. Hunt for the artifacts, not just the package names. Search node_modules, build caches and CI workspaces for setup.mjs, Math_Symbol.js and preinstall hooks calling node setup.mjs. Package lists are incomplete and were still growing; the file signature is stable.

2. Rotate every credential reachable from an affected build. Assume total compromise of npm tokens, GitHub PATs and Actions secrets, AWS keys, Kubernetes service account tokens, Vault tokens, SSH and private keys, database connection strings, and third party API keys including Slack and Stripe. Rotate rather than audit first, given the malware dumps Actions runner memory for ephemeral tokens.

3. Disable lifecycle scripts by default. Run installs with --ignore-scripts in CI and enforce it via .npmrc. This single control blocks the entire ChainDrop execution chain at the preinstall stage.

4. Pin and lock, and check install dates against August 4. Any npm install or CI build that resolved fresh versions of the cache family or the affected corporate scopes on or after roughly 09:00 UTC on August 4, 2026 should be treated as suspect. Remember the transitive path through tooling such as ESLint: absence from your package.json proves nothing.

5. Stop treating provenance as a security gate. Valid attestation was the attack's cover, not its obstacle. Pair provenance checks with commit authorship review, branch protection requiring reviewed pull requests, and release approval gates so that a push to main cannot alone trigger a publish.

6. Inspect AI tooling and editor configuration in your repositories. Per Microsoft, the worm plants Claude and Visual Studio Code configuration files for persistence. Diff these against known good state across all repositories touched by potentially compromised GitHub identities.

7. Harden maintainer accounts and publishing identities. Enforce phishing resistant MFA on GitHub and npm, scope publishing tokens as narrowly as possible, prefer short lived OIDC based publishing over long lived tokens, and require manual approval for release workflows.

Sources: ChainDrop supply chain compromise: Anatomy of a self-propagating wo... | Massive ChainDrop npm supply-chain attack infects hundreds of packages | ChainDrop credential stealing worm infects over 400 npm packages... | Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack - S... | ChainDrop Worm Hits 400 npm Packages with Two Billion Monthly Insta... | ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and... | ChainDrop npm Worm Poisons 2,200+ Releases and Turns Valid Provenan... | A worm tore through npm by making the malware look perfectly legiti...