ChainDrop: The npm Worm That Compromised 444 Packages in Under…

Analysis of the August 4, 2026 ChainDrop attack: a self-replicating npm worm that abused OIDC Trusted Publishing with valid SLSA provenance to spread, stealing CI/CD credentials and planting persistence in IDEs and AI tools via an EtherHiding C2 on Ethereum.

Key Takeaways

On August 4, 2026, a self-replicating npm worm dubbed ChainDrop compromised 444 packages and 2,212 versions in under four hours, with numbers still climbing
The attack originated from the compromise of Jared Wray’s GitHub account, maintainer of packages totaling over 150 million weekly downloads
Malicious packages were published via OIDC Trusted Publishing with valid SLSA provenance, making automated detection difficult
A 727,680-byte second-stage payload stole CI/CD credentials to self-replicate and installed persistence in IDEs and AI tools
The C2 leveraged the EtherHiding technique on the Ethereum blockchain for censorship-resistant commands

The Attack in Brief

On August 4, 2026, at 09:02:37 UTC, a malicious commit (ee2681a, message "release: v6.0.0") was pushed to the jaredwray/keyv repository on GitHub. At 09:04:30 UTC, a second commit (d8c850c, "chore: update config") planted persistence hooks for IDEs and AI agents.

By 18:10 UTC the same day, the ChainDrop worm had compromised 444 packages and 2,212 versions—all in under four hours. The numbers continued to grow as technical analyses were published.

The attack initially hit three of Jared Wray’s repositories. Wray maintains foundational Node.js ecosystem packages: keyv, cacheable, flat-cache, file-entry-cache, cacheable-request, cache-manager, and ecto. keyv@6.0.0 alone accounted for over 150 million weekly downloads; flat-cache@6.1.24 logged 149,868,983 and file-entry-cache@11.1.6 counted 147,558,494.

"444 packages and 2,212 versions across more than a dozen victim organizations" — StepSecurity, 18:10 UTC August 4, 2026

How the Worm Works

ChainDrop represents an advanced evolution of the Shai-Hulud 2.0 malware family, previously observed in the May 2026 Mini Shai Hulud campaign against TanStack, Mistral AI, and OpenSearch. The novelty lies in its self-propagation capability combined with the abuse of legitimate trust mechanisms.

Every infected version follows the same pattern: a preinstall script ("node setup.mjs") downloads the Bun JavaScript runtime from official GitHub releases, then executes a 710 KB (727,680-byte) obfuscated second-stage payload named Math_Symbol.js (renamed math_init.js in the second wave).

The payload enumerated and stole credentials from CI/CD environments, expanding targets by roughly 70% over prior variants: credential stores for AI agents (Claude, OpenAI, Codex, Cursor, Gemini), cryptocurrency keystores (Foundry, Solana, Monero), self-hosted CI secrets (Jenkins master.key, Argo CD, Harbor), cloud configurations (Alibaba Cloud, Tencent Cloud), and system files.

A particularly insidious mechanism is the "token revocation watcher": the worm installs a monitor that triggers an attacker payload when the stolen GitHub token is revoked, rendering simple credential rotation insufficient to stop the compromise.

The Trust Gap: Valid Provenance for Malicious Code

The most disturbing distribution vector in ChainDrop is the use of npm OIDC Trusted Publishing with valid SLSA provenance. This mechanism, designed to guarantee software traceability, was instead weaponized to lend legitimacy to infected packages.

As StepSecurity researchers observed: "Provenance proves which commit was built. It cannot prove the commit was authorized." Provenance attests to which commit was compiled, not that the commit was authorized or legitimate.

Aikido Security researchers, cited by BleepingComputer, confirmed: "The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions."

This aspect makes the attack especially difficult for automated security systems that rely on the presence of provenance as a trust signal.

Immediate Actions

Organizations using npm packages must act on three fronts specific to the ChainDrop case.

First: verify installation of the compromised versions listed in StepSecurity’s IOC tables. Researchers stated explicitly: "If you installed any of the affected versions listed below, assume your system is compromised." Versions include keyv@6.0.0, flat-cache@6.1.24, file-entry-cache@11.1.6, and hundreds of others.

Second: inspect IDE persistence files in project directories, particularly .claude/settings.json (SessionStart hook) and .vscode/tasks.json (runOn: folderOpen), along with any modified GitHub Copilot configurations. The worm plants these hooks to maintain access even after the npm package is removed.

Third: monitor the npm-cache[.]com domain identified by Wiz as exfiltration infrastructure, and check for connections to suspicious Ethereum smart contracts, given the use of EtherHiding for C2.

Fourth: recognize that revoking GitHub tokens alone is insufficient. The worm’s token revocation watcher demands a structured, incident-driven response, with isolation of compromised systems before credential rotation.

Implications for the Open Source Ecosystem

ChainDrop raises structural questions about software supply chain security. Compromised packages collectively accounted for 2 billion monthly downloads, according to BleepingComputer. Confirmed victim organizations beyond the jaredwray ecosystem include Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.

Jared Wray confirmed via X that he used OIDC with npm and one-time codes for GitHub, not long-lived static tokens. The initial account compromise vector remains not fully clarified in available sources. Wray regained account access around 20:00 UTC on August 4.

StepSecurity’s runtime detonation log shows "Suspicious Processes 1" during installation of the keyv tarball at 11:13:16 UTC on August 4, confirming malicious execution activity.

Expel researchers provided cryptographic hashes for compromise indicators: for setup.mjs, MD5 f92ee93a0af971a3966bfa8efa9c2625, SHA-1 e65b155ce74f3f81fb7d2b5b60f8e62b36e6d69c, SHA-256 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668.

Information verified against cited sources and current as of publication.

Sources

Sources and references