Dateline: August 8, 2026
It started at 9 in the morning. By lunchtime, more than 1,500 poisoned software versions had flooded the world’s biggest code library. No one had to click a bad link. No one got tricked by a fake email. Developers just ran a normal install, and a worm slipped in.
The campaign is called ChainDrop, and it hit packages that get billions of downloads every month.
What Happened?
On August 4, an attacker took over the account of a developer who maintains a popular code library. That library helps apps store and grab data quickly. It alone pulls in more than 100 million downloads a week.
Once inside, the attacker pushed bad files straight to the project and cut a fresh release. Because the release was signed through the normal build pipeline, it looked legit. That is what made it so dangerous.
The poisoned code carried a worm. Security teams traced it to the Shai-Hulud malware family, the same lineage behind earlier waves this year. This version earned a new name because it hides its command server inside the Ethereum blockchain, a trick that makes it harder to shut down.
Here is the nasty part. The malware runs during install, before your app code ever loads. So a routine build or dependency update was enough to set it off. Once running, it hunts for secrets.
- npm tokens.
- GitHub tokens.
- Cloud keys.
- Kubernetes configs.
- Vault tokens.
It grabs them, encrypts them, and ships them out. Then it uses those stolen keys to jump to the next maintainer and spread on its own. Within hours, more than 400 packages were hit. Some trackers put the count far higher.
What’s the Impact?
The reach here is huge. The affected packages add up to roughly 2 billion downloads a month. These are not obscure tools. They are the plumbing sitting under thousands of Node.js projects, including code tied to well-known companies.
If a poisoned version landed in your build, the damage does not stop at your code. The worm treats your developer machine or your build server as a doorway. From there it reaches into your cloud accounts and your secret stores.
And because it copies itself using stolen credentials, one compromised laptop can seed the next round of attacks. That is how 11 starter packages turned into hundreds in a couple of hours.
ChainDrop npm Worm
Indicators of Compromise
Network
| Type | Indicator | Note |
|---|---|---|
| Domain | npm-cache[.]com | Data exfiltration endpoint |
| User agent | Bun/1.3.13 | Seen on malicious calls |
| C2 method | Ethereum smart contract (EtherHiding) | Used to fetch C2 domains dynamically |
File and Package Artifacts
| Type | Indicator | Note |
|---|---|---|
| File | setup.mjs | Loader launched by preinstall hook |
| File | math_init.js | Obfuscated loader file |
| Behavior | preinstall lifecycle hook | Runs the payload during install, before app code loads |
| Payload | Large obfuscated Bun JavaScript bundle | Mini Shai-Hulud variant |
| Release pattern | Patch bump with no matching source commit, PR, or tag | Tarball modified and published directly |
Exfiltration Behavior
| Type | Indicator | Note |
|---|---|---|
| Repo description | Shai-Hulud: Here We Go Again | Attacker-created public GitHub repos holding stolen data |
| Targeted secrets | npm and GitHub tokens, AWS keys, Kubernetes configs, HashiCorp Vault tokens, SSH keys | Encrypted then exfiltrated |
Earliest Known Malicious Release
| Type | Indicator | Note |
|---|---|---|
| Timeline | 2026-08-04, first malicious release near 09:35 UTC | Burst of malicious versions roughly 09:40 to 11:44 UTC |
| Seed packages | keyv, cacheable, flat-cache, file-entry-cache and their dependents | Confirm live version lists with vendor trackers |
Sources: Wiz, Microsoft Threat Intelligence, Semgrep, StepSecurity, Aikido Security. Full and current package lists are published by Wiz, StepSecurity, Aikido, Socket, and Ox Security. Verify all indicators against these primary trackers before acting.
How to Avoid This
- Turn off install scripts in your build pipeline. Adding the ignore-scripts flag would have blocked the preinstall step that delivers this payload.
- Set a minimum age on new package versions. Most package managers now let you wait 3 to 7 days before pulling a fresh release. That buys time for bad versions to get caught.
- Rebuild any machine that installed an affected version. Do not just remove the package. Rotate every token, key, and secret that machine could reach.
- Use allowlists, integrity checks, and provenance controls so a poisoned version cannot sneak in unnoticed.
- Check the IOC list below and match it against your build logs and lockfiles.
Your Weakest Dependency Is Already Inside Your Build
ChainDrop proves that attackers no longer need to breach you. They just wait for you to install their code.
Secure.com’s Digital Security Teammates help you close that gap:
- Scan dependencies in your pipeline and flag risky packages before they ship
- Detect exposed secrets in code and trigger rotation workflows fast
- Track third-party and supply chain risk in one register with clear ownership
- Block deployments tied to known-bad or unpatched components until they are fixed
- Keep watching after install, so a poisoned update does not sit quietly in your stack
