ChainDrop npm Worm 2026: How One Maintainer Account Spread a Credential Stealer to 400+ Packages in Hours

On 4 August 2026, a malicious release of keyv, an npm package with around 150 million weekly downloads, kicked off one of the fastest supply chain worms yet seen. Within about four hours, researchers counted 444 compromised packages and 2,212 malicious versions. The worm, named ChainDrop because it uses the Ethereum blockchain for command and control, stole npm tokens, GitHub tokens, CI secrets, cloud keys and even AI coding tool credentials from every machine that installed it, then used the stolen publishing tokens to infect more packages. It descends from the Shai-Hulud family, and it shows how a single maintainer identity can become a distribution channel for credential theft across the ecosystem.

At a glance

What happened

According to StepSecurity's timeline, a poisoned commit was pushed to the jaredwray/keyv repository at 09:02:37 UTC on 4 August 2026. At 09:35 UTC, [email protected] was published through the project's GitHub Actions workflow using OIDC trusted publishing, so the package carried the same trusted build path as a genuine release. Socket's detection flagged it about six minutes later. By 09:38 UTC a package from an unrelated publisher had been infected, showing the worm was already spreading with stolen tokens, and the cacheable family followed between 10:09 and 10:14 UTC.

CSO Online reported that the maintainer, Jared Wray, had used OpenID Connect with npm and one-time codes for GitHub rather than long-lived static tokens, yet attackers still gained access to his GitHub account. According to Aikido Security, as quoted by CSO Online, they "pushed malicious files directly to the main branch and then immediately cut a new release." Wray regained access at around 20:00 UTC and said he was "doing a full audit". Microsoft's analysis says that "Evidence points towards stolen maintainer credentials as the attack vector for initial compromise."

The malicious versions added a preinstall script that runs setup.mjs. This downloads the legitimate Bun JavaScript runtime from its official GitHub releases and uses it to run a heavily obfuscated second stage of 727,680 bytes, according to StepSecurity. That payload searches the machine for secrets. StepSecurity lists npm tokens, GitHub personal access tokens, AWS keys, GCP service accounts, Azure credentials, Kubernetes tokens, Vault credentials, Slack cookies, Docker configuration, SSH keys and, "new for this generation", AI tool credentials such as .claude/credentials.json, .codex/auth.json, .cursor/credentials.json, .openai/auth.json and .anthropic/auth.json. On GitHub Actions runners, it dumps the memory of the Runner.Worker process and searches it for secrets injected into the job, and Socket reports it also targets GitHub Actions OIDC.

Stolen data is encrypted and sent to attacker servers whose addresses are stored in an Ethereum smart contract. Changing the C2 domain needs only one blockchain transaction; Unit 42 observed exactly that on 4 August. As fallbacks, the worm creates public GitHub repositories, which Microsoft says carry the description "Shai-Hulud: Here We Go Again", and uses workflow artifacts and commit messages to leak tokens.

Researchers named the campaign ChainDrop "because this new version uses the Ethereum blockchain for command and control, a technique known as EtherHiding," according to CSO Online. Unit 42 traces its infrastructure back to May 2026, with the earliest compromised repository created on 11 May, C2 domains registered on 22 May and the Ethereum contract deployed on 25 May.

Timeline

How it happened: the identity attack path

1. Maintainer identity taken over. The attacker gained access to the maintainer's GitHub account despite the use of OIDC for npm and one-time codes for GitHub.
2. Trusted pipeline abused. A commit to the main branch triggered the project's own release workflow, which published to npm through OIDC trusted publishing. No npm token had to be stolen for the first release.
3. Secrets harvested at install time. The preinstall hook ran on every developer machine and CI runner that installed an affected version, collecting tokens, keys and cloud credentials from files, environment variables and process memory.
4. Stolen publishing tokens reused. The worm "enumerates every package the victim can publish", injects its payload, increments the patch version and republishes, as StepSecurity describes. Each new victim with publishing rights became a new source of infection.
5. Provenance kept intact. Unit 42 found one variant used GitHub Actions trusted publishing to obtain npm credentials and published with valid Sigstore provenance.
6. Persistence in developer tools. Malicious tasks in .vscode/tasks.json run when a folder is opened, and a SessionStart hook in .claude/settings.json runs when Claude Code starts.
7. Revocation trap. Microsoft reports a token-monitor component with "a destructive handler if the monitored token is revoked", so responders need to clean hosts before revoking.

Impact

• Packages: 444 packages and 2,212 malicious versions according to StepSecurity; Microsoft and Unit 42 report more than 400 packages.
• Reach: figures vary by source. The Register and CSO Online put combined downloads at about 2 billion a month; Unit 42 says hundreds of millions weekly; Socket's early analysis of the first wave described tens of millions of weekly downloads.
• Exfiltration repositories: Unit 42 identified 453 public exfiltration repositories across five accounts.
• Credentials: Microsoft advises that any developer workstation or build runner that installed an affected version with lifecycle scripts enabled be treated as potentially compromised.

What this means for NHI governance

ChainDrop is a machine identity problem from start to finish. The first release came from a hijacked maintainer account driving a legitimate CI workflow. Every later release came from stolen npm publishing tokens. The payload's shopping list is a catalogue of non-human identities: cloud keys, Kubernetes service account tokens, Vault tokens, CI secrets, SSH keys and, increasingly, the credentials of AI coding assistants.

Two points stand out. First, trusted publishing and signed provenance are valuable, but they attest to the build path, not to the intent of whoever controls it. If the maintainer account or workflow is compromised, the malicious package arrives with valid provenance. Second, the worm targets CI runners directly, reading secrets from memory. Any secret injected into a build job is only as safe as every dependency installed in that job.

ChainDrop follows the Shai-Hulud campaign and the Miasma and Hades worms, each of which turned developer tokens into a means of spreading.

Recommendations

• Disable install scripts in CI. Use --ignore-scripts where possible and allow lifecycle scripts only for packages that need them.
• Delay new releases. Configure a minimum release age of several days for dependency updates, and confirm your package manager version actually enforces it.
• Protect release workflows. Require reviewer approval for release jobs, protect main branches and alert on force pushes and tag deletions.
• Minimise secrets in build jobs. Give each job only the credentials it needs, and prefer short-lived federated credentials. See the Cloud Workload Identity Guide and NHI Authentication Guide.
• Clean before revoking, then rotate everything. Remove persistence from .vscode and .claude folders and other artifacts, then rotate npm, GitHub, cloud, Kubernetes, Vault, SSH and AI tool credentials the host could reach. Challenges of Rotating NHIs explains why this is hard at scale.
• Inventory publishing identities. Know which people and tokens can publish each package you own, and remove any that are not needed, following the NHI Lifecycle Management Guide.

Frequently asked questions

What is the ChainDrop npm worm?

ChainDrop is a self-propagating credential-stealing worm that compromised more than 400 npm packages on 4 August 2026, starting with keyv. It is related to the Shai-Hulud malware family and uses an Ethereum smart contract to find its command-and-control servers.

How did ChainDrop spread?

It stole npm publishing tokens from machines that installed an infected package, then downloaded every package those tokens could publish, injected its code and released new versions.

Did trusted publishing stop ChainDrop?

No. The first malicious keyv release was published by the project's own GitHub Actions workflow using trusted publishing, after the attacker pushed a commit from the maintainer's compromised account. Unit 42 also found a variant that published with valid provenance.

Related NHI Mgmt Group resources

Shai-Hulud npm campaign · Miasma and Hades worms · Mastra npm supply chain attack · Leaked SpotBugs token · CI/CD pipeline exploitation · NHI breaches

How NHI Mgmt Group can help

Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target publishing tokens, CI secrets, cloud credentials, API keys and AI tool tokens. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.

References

• Microsoft Security Blog: ChainDrop supply chain compromise, anatomy of a self-propagating worm (4 August 2026)
• StepSecurity: ChainDrop npm Worm, Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 (4 August 2026)
• Socket: Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack (4 August 2026)
• Datadog Security Labs: 'ChainDrop' worm compromises hundreds of popular npm packages (4 August 2026, updated 5 August 2026)
• Palo Alto Networks Unit 42: ChainDrop, Inside a Self-Propagating npm Worm (6 August 2026, updated 10 September 2026)
• CSO Online: ChainDrop credential stealing worm infects over 400 npm packages (4 August 2026)
• The Register: ChainDrop worm crawls into npm supply chain, evades standard defenses (15 August 2026)