A self-propagating npm worm called ChainDrop compromised 444 packages — including keyv (600M monthly downloads), flat-cache, and file-entry-cache — on August 4, 2026, spreading in under four hours and exposing roughly 2 billion weekly installations to credential theft. The worm is attributed to the Shai Hulud malware family, the same threat actor behind the May 2026 campaign that hit TanStack, Mistral AI, and OpenSearch packages. If you or your CI pipelines ran npm install
between 09:35 and 13:18 UTC on August 4, treat those machines as compromised and act now.
How ChainDrop Spread in Under Four Hours #
Attackers started by compromising the GitHub account of Jared Wray, the maintainer behind keyv, cacheable, flat-cache, and file-entry-cache — packages that collectively pull 1.877 billion monthly downloads. Malicious commits went straight to the main branch and triggered the projects’ own GitHub Actions release workflows. The published packages arrived with valid SLSA provenance attestations, because the legitimate CI/CD pipeline ran them.
Those infected packages contained a preinstall
lifecycle hook that downloaded the official Bun JavaScript runtime (without cryptographic verification), then executed a 727KB obfuscated Stage 2 payload under Bun instead of Node.js — deliberately evading Node-specific monitoring tools. The payload stole credentials, reported home, and then used stolen npm tokens to republish more infected packages, incrementing patch versions to slide past version pinning. In four hours: 444 packages, 2,234 poisoned versions.
The SLSA provenance angle is worth sitting with: provenance attestations signed correctly. Security tooling that validates Sigstore signatures would have seen nothing wrong. The fix is account security — hardware MFA, publishing automation restrictions — not artifact signing. Provenance tells you who signed; it doesn’t tell you whether their account was under attacker control at signing time.
Related:[Refuse: Block Vulnerable Package Installs Before Your AI Agent Does]
What the npm Worm Steals — Including Your AI Coding Tools #
The payload’s credential harvest is comprehensive: npm tokens, GitHub PATs, GitHub Actions runner memory secrets, AWS IAM credentials across 16 regions, GCP and Azure service accounts, Kubernetes configs, SSH private keys, HashiCorp Vault tokens, Docker Hub and Helm credentials, and cryptocurrency wallet files. However, there’s a detail specific to developers using AI coding tools: the worm targets their authentication explicitly. Elastic Security Labs confirmed that ChainDrop adds a SessionStart hook inside .claude/settings.json
that runs malicious code whenever a Claude Code session starts, and a folderOpen task in .vscode/tasks.json
that fires when developers open infected project folders.
This persistence design is deliberate. AI coding tools have broad filesystem access to entire codebases, and they run frequently. Even after developers upgrade the affected packages, an already-compromised machine continues executing the payload on every new session. The worm was engineered to exploit the developer workflow itself, not just the install moment.
The Blockchain C2 That Domain Blocking Cannot Touch #
ChainDrop’s command-and-control architecture is what separates it from most npm supply chain attacks. Rather than hardcoded domains, the worm queries Ethereum mainnet smart contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103
via 75 public RPC endpoints to get current exfiltration targets. On August 4, operators rotated the entire C2 infrastructure with a single on-chain transaction — no payload update required. Traditional DNS/TLS blocking, firewall rules, and domain reputation lists are all irrelevant here. The only reliable control is preventing initial execution or treating any machine that ran npm install during the attack window as fully compromised.
ChainDrop npm Worm: What To Do Right Now #
If your lockfile contains any of these versions — keyv@6.0.0, flat-cache@6.1.24, file-entry-cache@11.1.6, cacheable-request@13.0.20, cacheable@2.5.1, cache-manager@7.2.10 — or if your CI runners ran npm install during the attack window, act in this order:
Delete the ghost file first: Remove~/.local/bin/gh-token-monitor.sh
before rotating any credentials. This file monitors for token rotation events and re-exfiltrates fresh credentials — rotating without removing it hands the attacker your new tokens immediately.Revoke all credentials: npm tokens, GitHub PATs, AWS IAM keys, GCP/Azure service accounts, Kubernetes service account tokens, SSH keys, and Vault tokens.Hunt for malware artifacts: Search repositories and local environments forsetup.mjs
,math_init.js
,Math_Symbol.js
, androuter_runtime.js
. Check.vscode/tasks.json
and.claude/settings.json
for unauthorized hooks.**Treat CI runners as compromised:** Spin up fresh runners entirely. Don’t rotate secrets and keep using existing runner instances — they may carry embedded but not-yet-executed persistence artifacts.**Disable lifecycle scripts during investigation:** Run`npm config set ignore-scripts true`
and audit your full lockfile against[the published list of compromised package versions](https://safedep.io/keyv-npm-supply-chain-compromise/).
Key Takeaways #
- ChainDrop compromised 444 npm packages in under four hours on August 4, 2026, via maintainer account compromise and automated self-propagation through stolen npm tokens
- SLSA/Sigstore provenance attestations did not protect against this attack — the legitimate CI pipeline was used, so everything signed correctly
- The worm specifically targets AI coding tool credentials, including Claude Code session hooks (
.claude/settings.json
) and VS Code tasks, for persistent re-execution after the initial compromise - Blockchain-based C2 via Ethereum smart contract makes domain blocking ineffective — treat any machine that ran npm install during the attack window as fully compromised
- Delete
~/.local/bin/gh-token-monitor.sh
before rotating credentials — the worm re-exfiltrates new tokens if you rotate in the wrong order