Three months after the TanStack compromise showed that a CI pipeline could be turned against its owner, ChainDrop showed the other path in: take over the person.

The timeline

According to StepSecurity’s analysis, the attacker gained control of the GitHub account belonging to the maintainer of keyv, cacheable and ecto, widely used caching libraries in the Node ecosystem. On August 4, 2026:

  • 09:02 UTC: a poisoned commit was pushed straight to main.
  • 09:35 UTC: GitHub Actions built and published keyv 6.0.0 through npm’s OIDC trusted publishing. No long-lived npm token was involved, and the release carried valid SLSA provenance.
  • 10:39 UTC: npm began unpublishing malicious versions.
  • 13:20 UTC: a second wave had finished spreading.

By then the worm had used the credentials of developers who installed it to republish their own packages, under scopes including @servicetitan, @onereach and @qlik. StepSecurity counted 444 packages and 2,212 versions. Aikido counted at least 444 packages and 1,381 versions, with more than two billion combined monthly installs. The researchers disagree on versions; they agree on the scale.

What it did on your machine

Microsoft, StepSecurity and Aikido describe the same chain:

  1. A preinstall hook ran a small setup.mjs script.
  2. That downloaded the genuine Bun runtime and used it to run an obfuscated second stage of roughly 727 KB.
  3. The second stage harvested npm, GitHub, AWS, Kubernetes and Vault credentials, and on CI it read GitHub Actions runner memory.

It found its command server through an Ethereum smart contract, a technique researchers call EtherHiding, and sent data to a lookalike domain, npm-cache[.]com, which Aikido says was registered in May. Like other worms in this family it planted persistence in .claude/ and .vscode/ folders, and Microsoft notes it exited on Russian-language systems. Microsoft singled out its automatic propagation as its most significant capability.

Why provenance didn’t help

StepSecurity put the problem neatly: provenance proves which commit was built, not that anyone authorised that commit. When the attacker is the maintainer, as far as GitHub can tell, every safeguard downstream of the account works exactly as designed, for the attacker.

What to do

Microsoft’s published mitigations are a reasonable checklist for any team:

  • Upgrade to npm CLI v12, which stops dependency install scripts from running by default, the step this payload relied on.
  • Set a minimum release age so brand-new versions aren’t installed the moment they appear. Most worm waves are caught within hours.
  • Purge package caches on developer machines and CI runners.
  • Rotate credentials from a clean host, not from a machine that may still be infected.

For maintainers, the lesson is older than npm: a hardware security key on your GitHub account and branch protection on main are now part of your users’ supply chain.

Sources

  1. Microsoft Security Blog: ChainDrop supply chain compromise, anatomy of a self-propagating worm (Aug 4, 2026)
  2. StepSecurity: ChainDrop npm worm (Aug 4, 2026)
  3. Aikido: keyv and friends compromised in npm supply chain attack (Aug 4, updated Aug 5, 2026)

We link every claim to the reporting or official statement it comes from. Where a detail rests on one outlet’s reporting, we say so. Spotted an error? Reply to any newsletter and we’ll correct it.