A worm is after your AI keys. The install is the door.

On August 4, 2026, a malicious commit to the npm package 'keyv' triggered a supply-chain worm that compromised over 400 packages (Elastic) or over 1,300 package versions (Singapore's CSA), totaling more than a billion or 2 billion monthly downloads respectively. The worm, a descendant of the Shai-Hulud family tracked as ChainDrop, steals AI tool credentials (Anthropic, Claude, Codex, Cursor, OpenAI, Gemini) and persists via editor configs, with Datadog, Wiz, and Elastic flagging it the same morning. Snyk noted that the legitimate CI pipeline built and attested the malicious artifact, underscoring the risk of trusting default toolchains.

The Signal · Issue 5 A worm is after your AI keys. The install is the door. The short version On August 4 a poisoned commit landed in the Datadog, Wiz, and Elastic caught it the same morning. It is a member of the Shai-Hulud family, tracked as ChainDrop by Microsoft and others, and it hit the keyv repository, and a self-spreading worm went through the npm supply chain from there. cacheable , flat-cache , and file-entry-cache families alongside keyv . Nothing was hacked in the way people mean the word. The worm rides a normal npm feature: a preinstall script runs code before a package is installed. Running npm install did exactly what it always does, which is execute whatever the package author put in that hook. What it steals is the whole story. Past npm, GitHub, and cloud tokens, it goes for the credential stores of your AI tools. Elastic found it “aimed at AI tooling credentials such as Anthropic, Claude, Codex, Cursor, OpenAI, and Gemini.” It hides where you would never look for malware: your editor config. It plants a start-up hook in .claude/settings.json and an open-folder task in .vscode/tasks.json , so the act of opening the project runs it again. The Register put it plainly: “Simply opening an infected Git branch in VS Code or Claude Code can bring your repository under ChainDrop’s control.” The green checkmark meant nothing. The malicious code sat in the tagged source, so the real CI pipeline built and signed it. Snyk’s finding is the quiet horror of the whole event: “the legitimate workflow built and attested the malicious artifact.” The argument: the solo builder’s real exposure is the trust handed to the toolchain, not the code they typed. Auto-install, auto-run, an agent holding live keys to everything: that convenience is the execution path the worm rides. The one place left to stop trusting defaults is your own AI setup. What actually happened On August 4, 2026, someone pushed a malicious commit to the repository behind keyv , a caching library that a great many projects depend on without ever naming it. Within the same morning three security firms, Datadog, Wiz, and Elastic, had independently flagged it. The malware is a descendant of Shai-Hulud, the self-propagating npm worm that has surfaced before; Wiz calls this one “a descendant of the ‘Mini’ Shai-Hulud malware family,” https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack and Microsoft and Elastic track the variant as ChainDrop. The scale depends on who you ask and what they counted, so here it is unmerged. Elastic reported over 400 unique packages compromised, totaling more than a billion monthly downloads. Singapore’s national cyber agency, in an advisory first posted August 6 and still being updated on August 28, counted “over 1,300 package versions on the npm registry, representing a combined 2 billion monthly downloads.” https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/ Packages, versions, and downloads are three different things; anyone quoting a single tidy number for this is guessing. The install runs a stranger’s code Here is the mechanism, because it is the point. An npm package can declare a preinstall script, a command that runs automatically before the package is even installed. It is a legitimate feature, used for real setup work. The worm uses it to run a small first-stage loader whose only job is to start a much larger payload under the Bun runtime. If Bun is not present, the loader downloads it, and Datadog notes it “does not cryptographically verify” the release asset it fetches. The second stage is a heavily obfuscated program that phones home through an unusual channel: instead of a hardcoded server, it reads an Ethereum smart contract to look up the current address to send your secrets to. None of that required a vulnerability. It required you to type npm install , which you did, because that is the job. Every dependency you add is a decision to run its author’s code on your machine with your permissions, and almost nobody reads it first. The worm did not break that trust. It used it exactly as designed. What it reaches for The take list reads like an inventory of a modern builder’s whole life. npm tokens and GitHub tokens, so it can spread. Cloud credentials across AWS, Google, Azure, and Alibaba. HashiCorp Vault tokens, SSH private keys, Kubernetes service-account tokens. On a Linux CI runner, Datadog found it reaching into the build process’s memory to pull GitHub Actions secrets that were never written to disk. And then the new entry, the one that makes this a story for people who build with AI rather than a generic supply-chain writeup: the API keys sitting in your AI tools. Both Elastic and Wiz, working separately, list the same targets, Claude, OpenAI, Codex, Cursor, and Gemini. Those keys are now worth stealing next to your AWS root credentials, because a stolen model key is metered spending someone else gets to do on your account, and because the tools that hold them are the least-guarded thing on the machine. The part that lives in your editor This is the detail worth sitting with. The worm does not only steal and leave. It establishes persistence in the two config files a working developer opens every day. It writes a start-up hook into .claude/settings.json and an open-folder task into .vscode/tasks.json , each pointed at a dropped script. The reporting differs on exactly which file points where, so read it as the mechanism rather than one clean mapping: opening the repository in Claude Code or VS Code re-runs the loader. Think about what that means for how you work. You clone a repo, or check out a branch, or let an agent pull a project down, and you open it in your editor to look. That open is now an execution event. The place you were trained to treat as inert, a settings file, a tasks file, is where the thing waits. Your AI editor became a launch surface, and nothing about opening a folder feels like running a program. Why “read the code” is not the answer The reflexive advice is to audit your dependencies, and it is not wrong, but this event is precisely engineered to defeat the version of that advice most people can actually follow. The malicious code was in the tagged source when the maintainer’s own continuous-integration pipeline ran, so npm’s provenance and attestation, the cryptographic proof that a package was built by the pipeline it claims, worked perfectly and signed the poison. The badge that is supposed to mean “this is the real build” meant exactly that, and the real build was compromised. Provenance is a good thing that would not have saved you here, and pretending otherwise is how the next one gets through. The uncomfortable part Everything that makes one-person software possible is a delegation of trust, and the worm is a receipt for all of it at once. You install packages you have not read, because reading every transitive dependency is not a thing a human does. You let a coding agent add and install dependencies for you, because that is half the point of the agent. You keep live keys to your cloud, your repos, and your models on the same laptop, because a solo builder is the ops team too. Each of those is reasonable on its own. Together they are a machine that runs untrusted code with your full authority, on your instruction, several times a day. That is not a moral failing and it is not fixable by being more careful in the ordinary sense. It is the shape of the work. The worm did not exploit a bug in any of these tools. It exploited the arrangement, and the arrangement is the one that lets you ship. What to do this week None of the defenses are clever, and all of them are worth doing before the next variant, because there is always a next variant. Install without running lifecycle scripts by default. npm ci --ignore-scripts neutralizes the exact trigger this worm uses, and you turn scripts back on deliberately for the few packages that genuinely need them. Pin your dependencies to known-good versions in the lockfile instead of accepting whatever patch bump arrives. The worm shipped as patch releases, so an unpinned install in CI is a way for it to travel. Rotate the keys, from a machine you are sure is clean, and put your AI-provider keys on that list next to the cloud ones: Claude, OpenAI, Codex, Cursor, Gemini. Turn on two-factor for anything that can publish a package; the worm only spreads through a stolen token when that token is allowed to publish without it. Then look in the two places you never look. An unexpected start-up hook in .claude/settings.json , an open-folder task in .vscode/tasks.json , a stray setup script in either directory, a commit that says “update config” and touches neither of the things you were working on. Those are the door propped open behind you. The tools got good enough to run your entire shop from one terminal. That is exactly why the install, the editor, and the agent are now the things worth attacking, and why the last habit standing is to stop assuming your own toolchain is on your side by default. One email, when there's something worth sending Get the research in your inbox. No fixed schedule, no filler. You get an email when we've tested something, run the numbers, or found a tool worth your time. Free. Double opt-in, unsubscribe in one click. Got a signal we missed? Bring it to the forum ↗ https://community.okaneland.com Sources & how we researched this Datadog Security Labs, "Worm compromises hundreds of popular npm packages" Aug 2026 . First-stage loader, the unverified Bun download, and the deep AWS/Secrets Manager/SSM and CI-runner-memory collectors are its analysis. https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/ Elastic Security Labs, "Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages" Aug 2026 . Source for the preinstall trigger, the Ethereum dead-drop C2, self-propagation criteria, and the AI-tooling credential targets. https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain Wiz, "keyv and cacheable npm Package Hijacked in Supply Chain Attack" Aug 2026 . Names the Shai-Hulud "Mini" family and independently lists the AI-agent credential stores targeted. https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack Snyk, "Inside the keyv npm Supply Chain Compromise" Aug 2026 . Documents the IDE-hook persistence, the lockfile-pin and --ignore-scripts defenses, and that npm provenance attested the malicious build. https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/ Cyber Security Agency of Singapore, advisory AD-2026-009 published Aug 6, 2026, updated Aug 28 . Government advisory; source for the 1,300-versions scale figure and the remediation baseline. It does not itself cover the AI-config detail. https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/ The Register, "ChainDrop worm crawls into npm supply chain, evades standard defenses" Aug 15, 2026 . Secondary coverage; source of the "opening an infected branch in VS Code or Claude Code" line and the ChainDrop tracking name attributed to Microsoft. https://www.theregister.com/security/2026/08/15/chaindrop worm crawls into npm supply chain/ The Signal is Okane Land's weekly read on the AI news that changes a decision you make as a solo builder, verified to primary sources.