ChainDrop npm worm spreads to over 400 packages via compromised keyv maintainer

On August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account for the keyv project. The worm, a variant of Mini Shai-Hulud linked to TeamPCP, anchored its command-and-control infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a single blockchain transaction and rendering domain-based blocklists ineffective.

The attacker compromised the GitHub account of the keyv maintainer and pushed malicious code directly to the source repository, triggering the project’s own GitHub Actions-based release pipeline to build and publish poisoned versions of packages including keyv, cacheable, flat-cache, and file-entry-cache. Because the build originated from the legitimate repository and workflow, at least some of the resulting packages (most notably keyv 6.0.0) were published to npm bearing authentic SLSA provenance attestations, making them indistinguishable from clean releases to automated security tooling.

ChainDrop spread by stealing developer tokens and republishing infected versions of every package those tokens could reach. Aikido Security researchers found that the worm propagated to more than 400 packages. The payload performed a broad sweep of the infected environment, targeting npm tokens, GitHub personal access tokens, and cloud credentials, and if it found a valid npm token with publishing rights, it would enumerate all packages owned or writable by that token, inject the malicious files, bump the patch version, and publish the new poisoned version to the npm registry.

The worm used a preinstall hook to download the Bun runtime and execute an obfuscated payload, bypassing Node.js-focused scanners and endpoint detection and response tools. It also planted persistence hooks in VS Code and Claude Code configuration files, and included a destructive fallback that wipes the victim’s home directory if credential theft fails.