keyv and cacheable maintainer compromise seeded the ChainDrop worm

On August 4, 2026, an attacker took over the GitHub account of Jared Wray, the maintainer behind the keyv and cacheable npm families, and published malicious versions of ten widely used caching packages. Within four hours the worm those packages carried had poisoned 444 package names across 2,212 versions, reaching more than a dozen victim organizations.

The affected packages sit deep in the JavaScript dependency graph rather than at the top of it. [email protected] has more than 150 million weekly downloads, [email protected] around 149.9 million, and [email protected] roughly 147.6 million. Very few developers install them deliberately. Almost everyone installs them. The publishing path is what made the releases hard to dismiss. Rather than pushing tarballs by hand with a stolen npm token, the attacker committed malicious files directly to the main branch and immediately cut a release, so the poisoned versions went out through GitHub Actions with valid provenance attestations. Every package received two new files, setup.mjs and Math_Symbol.js, plus a "preinstall": "node setup.mjs" entry in package.json. The hook downloaded a standalone Bun runtime and executed an obfuscated second stage before npm install returned.

The payload collected npm and GitHub tokens, AWS credentials, HashiCorp Vault secrets, database connection strings, and private keys, and read GitHub Actions runner memory for secrets that never touch disk. It planted autostart hooks in .claude and .vscode directories so that a developer cloning affected source would run it again. Then it republished trojanized versions of every package the stolen token could reach, using npm's OIDC trusted publishing to mint credentials under legitimate workflow identities.

StepSecurity, which named the worm ChainDrop, documented the part that most interested defenders: the exfiltration endpoint was not hardcoded. The malware queried an Ethereum smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103 to retrieve the current address at runtime, rotating through roughly 60 public Ethereum RPC endpoints until one answered. Late on August 4, researchers watched the operator reconfigure the entire C2 infrastructure with a single Ethereum transaction, without touching the deployed malware. Wiz assessed the payload as a descendant of the Mini Shai-Hulud family used in the TeamPCP and AntV campaigns earlier in the year.