In short: A self-propagating worm named ChainDrop infected over 440 npm packages with a combined 2 billion monthly downloads. It steals GitHub tokens, SSH keys, AWS credentials and Kubernetes secrets, then uses those tokens to infect more packages — without any further attacker action. If you build Node.js projects, check whether your dependencies were compromised.
What happened
On August 4, 2026, attackers gained access to the GitHub account of the maintainer of keyv — a caching package with over 600 million monthly downloads. They inserted malicious code into the monorepo and triggered the existing GitHub Actions release workflows, publishing poisoned versions to npm with valid provenance attestations. Within four hours the worm had spread to over 440 packages and 2,212 versions. Our security blog has been tracking supply-chain attacks as the defining threat of the year — ChainDrop is the clearest example yet.
How the self-propagation works
Once inside a developer environment, ChainDrop operates in three stages:
- Harvest secrets: the malware scans environment variables, config files and
~/.sshfor npm tokens, GitHub Personal Access Tokens, AWS credentials (including Secrets Manager and SSM Parameter Store), Kubernetes configs, HashiCorp Vault secrets and database connection strings. - Self-propagate: using stolen npm tokens it enumerates every package the compromised account can publish, backdoors each one and republishes a new version — without any further attacker action.
- Exfiltrate: stolen secrets are encrypted and sent to a command server whose address is stored not in the code but in an Ethereum smart contract (the EtherHiding technique), defeating standard domain-blocklist defences.
Microsoft identified ChainDrop as a variant of the Mini Shai-Hulud family, whose source code was published openly in May 2026, lowering the barrier for any attacker to adapt and deploy it.
What was at risk
The most widely-used infected packages include keyv (600M+ downloads/month), flat-cache, cacheable-request, cacheable and cache-manager, with a combined audience exceeding 2 billion monthly downloads. Any developer whose CI/CD pipeline pulled these packages — and had cloud credentials or API tokens in scope — was exposed. The real danger is not direct user data leakage but infrastructure compromise: a stolen AWS key gives an attacker access to cloud storage, databases and everything behind them.
How to check and respond
Microsoft and Elastic recommend the following steps:
- Immediately revoke all npm and GitHub tokens used in CI/CD pipelines between August 4 and 7, 2026.
- Review npm publish history for unauthorised releases on accounts you own.
- Clear package caches and rebuild projects from scratch against the latest clean versions.
- Enable two-factor authentication on npm accounts and scope tokens to the minimum permissions needed.
- When installing new dependencies, wait 24–48 hours after a new version appears — most malicious releases are detected and yanked within that window.
Protecting your development environment matters as much as protecting production. The LiMP VPN app encrypts traffic between your machine and external services, reducing interception risk when coding from public networks — a separate but complementary layer to credential hygiene.