Shai-Hulud Returns: ChainDrop Worm Hits npm, Infecting Hundreds of Packages

On August 4, 2026, an attacker took over the GitHub account of the maintainer behind keyv, a key-value caching library with roughly hundreds of millions weekly npm downloads, and injected a credential-stealing worm across the maintainer's entire package family, including cacheable, flat-cache, file-entry-cache, and cache-manager. Tracked as ChainDrop, it spread to hundreds of additional packages with a combined two billion-plus monthly installs.

What makes it dangerous is not the download count but how the malicious code got trusted. The attacker published through the project's own automated release pipeline, so the poisoned versions carried valid provenance: signed proof that a package was built by the official pipeline from the real source. That proof is meant to be a safety signal. Here it was genuine, because the pipeline itself was compromised. To a developer, or to a security tool checking the signature, the malicious version looked completely authentic.

ChainDrop is the latest wave in a campaign researchers have tracked since September 2025: Shai-Hulud 1.0 (September 2025), 2.0 (November 2025), and Mini Shai-Hulud, Wave Four (May 2026). Each has escalated, with later variants adding more aggressive propagation and broader supply-chain exploits.

• Date: keyv@6.0.0 is the confirmed starting point, published on August 4, 2026.

• Entry point: The compromise began with a compromised maintainer GitHub account, and the malicious release went through the project’s legitimate publish pipeline.

• Scale: The numbers vary by tracker, but all reports agree this was a very large npm supply-chain incident. StepSecurity reported 435 packages / 1,557 versions early on, while Aikido and later reporting pushed the total higher, with some estimates above 1,300 packages and around 2 billion monthly downloads.

• Payload: There is a preinstall path using setup.mjs, which downloads Bun and launches a large obfuscated credential-stealing payload.

• Attribution: Researchers place it in the Shai-Hulud malware family.

What makes ChainDrop especially concerning is that it did not rely on a flashy exploit or a fake download site. Instead, it took advantage of the normal software supply chain — the same package publishing and installation process used by millions of developers.

In practical terms, that means a package can appear legitimate while quietly carrying malicious code that activates during installation. Security teams say the malware was built to steal secrets from developer machines and CI/CD systems, including GitHub tokens, npm credentials, AWS keys, Kubernetes secrets and other access data.

The broader risk is not limited to developers. Any organization that uses affected packages can inherit the compromise indirectly through build systems, dependencies and automated release pipelines.

ChainDrop is a reminder that open-source dependencies are a business risk, not just a developer concern.

For any organization that depends on JavaScript and Node.js software, ChainDrop is a reminder that open-source dependencies are a business risk, not just a developer concern.

A compromised package can be inherited indirectly through dependencies and build systems, and it can lead to stolen credentials, unauthorized access to cloud infrastructure, and large-scale secret rotation and incident response. Where software integrity, access control, and third-party risk sit inside your control environment, as they do under PCI DSS, DORA, NIS2, and CMMC, that exposure lands squarely on compliance and governance too.

If you may have installed an affected package on or after August 4, 2026:

• Scan your dependencies: Generate an SBOM and scan dependencies against known-malicious versions

• Image before you revoke: Image affected systems before rotating tokens. The malware watches for credential revocation and can trigger a handler if you rotate first.

• Rotate exposed secrets: Rotate every reachable secret (npm tokens, GitHub PATs, SSH keys, cloud credentials) and enforce MFA

• Check by exact version, not by name: Match by exact resolved version, not package name; registry tags shifted during the incident

• Remove the repo-level hooks: Inspect .claude/settings.json and .vscode/tasks.json, not just node_modules

• Audit CI/CD: Audit CI/CD and GitHub Actions for unexpected publishes or new workflows

The lesson is that the durable defense against this class of attack is inspecting what a component contains, instead of trusting where it came from.