ChainDrop Worm Compromises Over 1,300 npm Package Versions After keyv Maintainer's GitHub Account Is Breached
A self-propagating worm hijacked keyv and related npm packages on August 4 after a maintainer's GitHub account was breached, spreading to 1,300+ package versions.
Overview
A self-propagating worm compromised dozens of widely used npm packages beginning August 4, 2026, after attackers took over the GitHub account of jaredwray, the maintainer behind the caching library keyv, according to Snyk and DevOps.com. SecurityWeek has dubbed the campaign “ChainDrop,” while Singapore’s Cyber Security Agency tracks it as the latest wave of the “Shai-Hulud” worm family that has repeatedly hit the JavaScript ecosystem over the past year. By August 6, the compromise had grown to more than 1,300 malicious package versions with a combined 2 billion monthly downloads, according to a CSA advisory updated that day.
What We Know
The initial breach
Attackers gained control of jaredwray’s GitHub account and, according to Snyk, began committing malicious code to the keyv repository shortly after 09:00 UTC on August 4, publishing a poisoned keyv 6.0.0 release at 09:35 UTC. Over the next hour, related packages in the same maintainer’s namespace were compromised in the same way, including flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable-request 13.0.20, cacheable 2.5.1, @cacheable/memory 2.2.1, cache-manager 7.2.10, @cacheable/node-cache 3.1.2, @cacheable/utils 2.5.1, @cacheable/net 2.1.1 and ecto 5.0.1 — eleven directly compromised packages in total, a list corroborated by Aikido Security. Security researcher Charlie Eriksen posted public warnings about the compromise within roughly 45 minutes of the first malicious publish, Snyk’s incident timeline shows.
Because the malicious code was committed directly to each package’s source repository before being published, npm’s own provenance system — designed to cryptographically attest that a published package matches its source repository — validated the poisoned releases as legitimate. “Provenance remains valuable evidence about build origin. This incident shows its boundary: provenance can faithfully attest a build whose source or workflow context has already been compromised,” Snyk wrote. Aikido’s Ilyas Makari made a similar point to DevOps.com: “The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions.”
How the payload works
Each compromised package shipped with a preinstall script pointing to a file named setup.mjs, so the malicious code ran automatically the moment a developer or CI system ran npm install against an affected version — no further action required. “Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed,” Makari told DevOps.com. According to Snyk, setup.mjs was a roughly 30-kilobyte obfuscated loader that downloaded the Bun JavaScript runtime and used it to execute a second, far larger payload file named Math_Symbol.js — about 728 kilobytes of obfuscated code, a size confirmed independently by Aikido and DevOps.com.
That payload scanned infected machines for credentials, according to Wiz, targeting cloud provider keys, npm and GitHub tokens, Kubernetes and HashiCorp Vault secrets, cryptocurrency wallets and even system files such as /etc/shadow. Wiz identified specific targets including credential stores for AI coding tools such as Claude, OpenAI, Codex, Cursor and Gemini, along with self-hosted infrastructure secrets like Jenkins’ master.key. Aikido put the scan at roughly 200 glob patterns covering .env files, private keys, SSH keys, Terraform state, Docker configs and IDE configuration files, including .claude/settings.json.
Self-propagation and exfiltration
The worm did not stop at credential theft. Using stolen npm publishing tokens, it enumerated other packages the compromised account could publish to, then republished poisoned versions of them, according to Aikido. Endor Labs researcher Kiran Raj told DevOps.com that “the pattern is consistent across them: an npm publishing token was stolen and used to push malicious versions, in most cases a CI or service-account token likely harvested from a build runner that had itself installed a poisoned dependency.” Separately, using stolen GitHub App tokens, the malware committed to as many as 50 branches per repository on compromised accounts, authoring commits as “claude” with the message “chore: update config,” per Aikido.
Stolen data was exfiltrated to newly created public GitHub repositories under compromised identities, each carrying the default description “Shai-Hulud: Here We Go Again,” according to both Wiz and Aikido, which counted roughly 1,300 such repositories at the time of its report. For command-and-control, Aikido said the malware primarily reached a fallback domain, npm-cache[.]com, that was registered on May 22, 2026 — more than two months before the attack began — and also rotated endpoints through calls to an Ethereum smart contract, a technique SecurityWeek also flagged in its description of the malware’s use of the Ethereum blockchain for infrastructure.
Scale and lineage
Counts of the damage climbed as the campaign spread. SecurityWeek reported that more than 2,200 malicious package versions across 440 packages had been observed within four hours on August 4. By its own August 5 update, Aikido put the toll at no fewer than 444 packages across 1,381 versions with a combined 2 billion monthly installs, and named downstream projects whose own packages were subsequently infected, including those published under Deliveroo, Qlik and Picsart accounts. DevOps.com separately named Deliveroo, OneReach, ServiceTitan, Picsart and Qlik among organizations affected, and reported the campaign was adding 50 to 100 newly infected packages every few minutes during its most active phase. Singapore’s CSA advisory, last updated August 6, puts the cumulative total at more than 1,300 compromised versions with 2 billion monthly downloads combined.
Researchers differ slightly on how to place the malware within the broader Shai-Hulud worm lineage that has hit npm repeatedly since a 2025 outbreak. SecurityWeek described ChainDrop as “an evolved descendant of the Shai-Hulud 2.0 worm,” while Wiz characterized the malware as “a descendant of the ‘Mini’ Shai-Hulud malware family” — the same lineage The Machine Herald previously reported on when it hit TanStack, Mistral AI and UiPath packages in May.
What CSA and researchers recommend
Singapore’s CSA advisory instructs organizations to “identify and remove the affected package versions from development, build, and CI/CD environments,” “treat affected systems as potentially compromised and rebuild them if the malicious packages were installed,” “rotate exposed credentials, including cloud credentials, GitHub tokens, SSH keys, Kubernetes configurations, Terraform credentials,” and “monitor for the published IOCs, including the identified domains, file artifacts, and other indicators associated with the campaign.”
What We Don’t Know
The full, final scope of the compromise remains unclear; every source consulted for this article reported a different and growing count as the campaign continued to spread through automated republishing, and none represents a final tally. It is also not yet clear how the attacker initially gained access to jaredwray’s GitHub account — Snyk’s analysis indicates the intrusion points to an account, credential or session compromise rather than an authorized insider, but the precise entry vector (phishing, token theft, or otherwise) has not been publicly disclosed by any source reviewed here.