Loading story…
Attackers hijacked the GitHub account of maintainer Jared Wray and used legitimate GitHub Actions workflows to publish malicious npm releases for keyv and multiple cacheable-family packages, seeding a supply-chain worm now described as ChainDrop, a variant of Shai-Hulud. Researchers said the campaign expanded from an initial set of 11 malicious releases to 444 infected packages, touching dependencies such as keyv, flat-cache, and cache-manager that together see roughly 2 billion monthly downloads. The poisoned packages carried valid GitHub-signed provenance, but the malicious payload was inserted into npm tarballs and obfuscated preinstall paths, allowing the attack to evade checks that rely on source-repository visibility.
The malware stole npm tokens, GitHub credentials, cloud keys, environment variables, shell data, and secrets from memory, then encrypted and exfiltrated the data after resolving command-and-control infrastructure through an Ethereum smart contract. It also planted persistence in repository and IDE configuration files including .claude/settings.json and .vscode/tasks.json, meaning simply opening a seeded repository in tools such as VS Code or Claude Code could trigger compromise and further spread. With stolen GitHub access, the worm enumerated repositories and branches, committed malicious configuration files, and installed a revocation-triggered kill switch tied to stolen tokens; defenders were urged to roll back to known-safe versions, inspect branches for unauthorized config changes, remove persistence before revoking credentials, and treat any host that installed affected packages or opened a seeded repository as compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Multiple security researchers identified a large-scale npm supply chain attack using the Shai-Hulud variant later dubbed ChainDrop. The campaign was reported as infecting 444 npm packages from multiple publishers.
Additional compromised packages in the cacheable family were published between 10:09 and 10:14 UTC, followed by ecto at 10:28 UTC. Cycode identified 11 malicious releases across the maintainer's packages in this wave.
A malicious version of keyv, version 6.0.0, was published to npm through the repository's legitimate GitHub Actions workflow with valid GitHub-signed provenance. The release contained the worm's install hook and payload files.
A giveaway test file was removed from the compromised repository, indicating the attacker cleaned up evidence during the intrusion. Cycode placed this action after the malicious commit and persistence additions.
The attacker added persistence hooks to repository configuration files including .claude/settings.json and .vscode/tasks.json. These changes enabled compromise to trigger when a seeded repository was opened in tools such as VS Code or Claude Code.
Public commit records showed a malicious commit was pushed to the main branch of the keyv repository using maintainer Jared Wray's compromised GitHub account. This marked the start of the documented package compromise sequence.
Reporting on the ChainDrop campaign said the compromise ultimately involved more than 1,300 malicious npm releases across 444 packages representing over two billion monthly installs. The article also identified additional affected packages including flat-cache, file-entry-cache, and cacheable-request.
The exfiltration host npm-cache[.]com, later used by the malware's on-chain command-and-control setup, was registered. Cycode identified this domain as part of the campaign infrastructure.
The compromised packages were quickly removed from npm after the attack was identified. Reporting also noted that SafeDep published a list of affected packages and version numbers for defenders.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcenetskope.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcecycode.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers behind **Shai-Hulud** compromised the maintainer of the widely used npm library **`keyv`** and used a self-propagating worm dubbed **CHAINDROP** to trojanize the `keyv` monorepo and spread malicious updates across more than **400 npm packages**. The campaign abused npm **`preinstall`** hooks for code execution, stole developer credentials from infected machines, and automatically republished malicious package versions anywhere stolen npm tokens had write access, including cases where the tokens bypassed **2FA** protections. Packages tied to the `keyv` ecosystem, including **`flat-cache`**, **`cacheable-request`**, **`cacheable`**, and **`cache-manager`**, were identified as part of the downstream exposure, raising broad risk across JavaScript build pipelines and dependent applications. The malware expanded beyond package tampering by implanting **Claude Code** and **VS Code** execution hooks and harvesting secrets tied to AI tooling, cloud environments, GitHub, Kubernetes, Vault, SSH, and npm accounts. Elastic Security Labs reported that the operators used an **Ethereum smart contract** with fallback mechanisms to dynamically resolve exfiltration infrastructure, underscoring a more resilient and automated supply-chain tradecraft. Published guidance urged organizations to revoke GitHub and npm tokens, review repositories for suspicious commits attributed to **"claude"**, rotate exposed secrets, enable npm 2FA, and upgrade to **npm 12+** as defenders assess the blast radius of one of the largest recent npm ecosystem compromises.
Aug 12, 2026
A self-propagating npm supply-chain attack dubbed **ChainDrop** has spread through compromised package releases, with malicious versions using `preinstall` scripts to execute obfuscated files such as `setup.mjs` and `math_init.js`, download a runtime, and launch a second-stage payload. Researchers said the campaign hit many unrelated maintainer scopes in a short period, indicating automated propagation through stolen maintainer credentials or tokens, and described the malware as a CI/CD credential harvester that uses Bun-loaded components and Ethereum dead-drop command-and-control. StepSecurity said its OSS Security Feed flagged dozens of npm packages as **critical** during the outbreak and warned that the published list may be incomplete. The broader feed also highlighted recurring npm ecosystem risks including typosquatting, dropped provenance, repository mismatches, and install-time binary downloads, including a critical case where `free-email-domains` `v1.9.15` fetched content from the typosquatted domain `hubspotusercontent40.net` during `postinstall`. Defenders were urged to treat any environment that installed affected versions as compromised, rotate secrets, roll back to known-good releases, and inspect developer endpoints, CI runners, and package caches for persistence.
Aug 7, 2026
A software supply chain compromise hit the JavaScript ecosystem after malicious versions of **Keyv** and related npm packages were published through legitimate maintainer workflows, with `keyv@6.0.0` identified as a primary malicious release. Researchers said the tainted packages added a `preinstall` hook that executed attacker code during dependency installation on developer workstations and CI runners, while some repositories also contained malicious **VS Code** and **Claude Code** configuration files that could trigger execution when a cloned project was opened. Early community reports tied the incident to the `jaredwray/cacheable` package set and warned that numerous downstream dependencies were exposed. Analysis found the malware targeted high-value secrets including **GitHub** and **npm** tokens, cloud credentials, Vault tokens, Kubernetes service account tokens, SSH keys, and TLS certificates, with tradecraft resembling the **Shai-Hulud** malware family. Investigators reported no evidence that npm itself was breached; instead, the attackers appear to have used stolen maintainer credentials and trusted GitHub Actions publishing pipelines with valid provenance and npm attestation, demonstrating that provenance verified the build source but not whether the source had already been maliciously altered. Responders were urged to avoid affected versions, isolate any host that installed them, remove persistence such as `gh-token-monitor`, and rotate exposed credentials from a clean system.
Aug 8, 2026