A self-propagating worm named ChainDrop has compromised more than 1,300 packages on the npm registry, collectively accounting for roughly 2 billion monthly downloads. The attack began when a threat actor gained control of the GitHub account belonging to the maintainer of Keyv, a widely used key-value caching library. From there the worm spread automatically to dependent packages—including Cacheable, flat-cache, and file-entry-cache—and then reached packages maintained by engineers at Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.
What makes ChainDrop unusually dangerous is that the malicious code executes before installation completes. Each poisoned package gains a "preinstall": "node setup.mjs" entry in its package.json, which runs the dropper the moment a developer types npm install. The dropper silently downloads the Bun JavaScript runtime from GitHub, uses it to execute a credential-stealing script called Math_Symbol.js, then deletes the temporary Bun directory to hide its tracks. The stealer harvests API tokens, SSH keys, and cloud credentials from the developer’s environment and from any CI/CD runner that processes the project—validating each token against npmjs.org’s own /whoami endpoint in real time so only working credentials are exfiltrated. Stolen data is sent to a public GitHub repository titled “Shai-Hulud: Here We Go Again.” Because the poisoned packages were published through each project’s legitimate GitHub Actions workflow, they carry valid npm provenance attestations—the usual trust signal that a package came from its real source.
How to check if you’re affected
Affected versions of the poisoned packages—including Keyv, Cacheable, flat-cache, and file-entry-cache—were the ones published during the compromise window. Check your package-lock.json or yarn.lock for any of these packages and compare their installed versions against the safe versions listed in the Aikido Security advisory. If your project’s CI/CD pipeline ran against an affected version, treat all developer tokens, cloud API keys, and npm publish tokens in that environment as compromised and rotate them immediately. Affected models of risk include any Node.js development machine or build runner that ran npm install during the attack window.