ChainDrop npm Worm: Fix Your Lockfile Before You Rotate Credentials

On August 4, 2026, a self-propagating worm called ChainDrop tore through npm’s keyv and cacheable ecosystems, poisoning 444 packages that represent roughly two billion monthly downloads in under four hours. Most teams learned about it by checking their security feeds. The part security feeds buried: if you rotate credentials before removing the malware, you trigger a home-directory wiper.

What Got Hit and How Fast

ChainDrop entered through a compromised GitHub account belonging to Jared Wray, the maintainer behind keyv, cacheable, flat-cache, and file-entry-cache. The attacker pushed two malicious files — setup.mjs and Math_Symbol.js — directly to the main branch at around 09:00 UTC. The project’s own GitHub Actions pipeline then built and published the poisoned versions, meaning each release carried valid SLSA provenance signed by GitHub Actions. Provenance checks passed. Integrity checks passed. Everything looked legitimate.

From first malicious release (keyv@6.0.0 at 09:35 UTC) to peak propagation, the worm published roughly one infected package per second. By the time npm pulled the affected versions at approximately 17:40 UTC, ChainDrop had contaminated 444 packages across 2,212 versions. Affected organizations included Deliveroo, Picsart, and ServiceTitan. You can review the full attack timeline in Zscaler’s ThreatLabz analysis.

How the Worm Works

Every poisoned version carries the same preinstall hook. When any developer or CI/CD runner executes npm install on an affected package, setup.mjs runs automatically. It downloads a copy of the legitimate Bun JavaScript runtime — not on any npm blocklist — then executes a 710 KB obfuscated stealer called Math_Symbol.js.

The stealer harvests npm tokens, GitHub CLI tokens, AWS credentials, Kubernetes configs, SSH keys, Vault tokens, and crypto wallet files. Then it calls the npm registry API, lists every package the stolen token can publish, fetches each tarball, injects the same malicious preinstall hook, increments the version number, and republishes. That loop is how 444 packages became infected in a single afternoon. StepSecurity’s breakdown covers the full credential harvesting scope.

The Ethereum C2 Nobody Can Block

ChainDrop does not hardcode a command-and-control domain. Instead, it queries an Ethereum smart contract at address 0xE1f2395ee43e45A1556EC6438a88c31B83493103 to retrieve the current exfiltration endpoint at runtime. The attacker can rotate C2 infrastructure with a single blockchain transaction. Domain-based blocklists, IP reputation feeds, and firewall rules are all useless — the “address” lives on a public blockchain that every node in the network replicates.

If the Ethereum query fails, the worm falls back to scanning GitHub commit history for a cryptographically signed marker and validates any found domain against an embedded RSA public key. It rotates through roughly 60 public Ethereum RPC endpoints before giving up. This is the most resilient C2 architecture seen in a supply chain attack to date.

Your AI Coding Assistant Was a Target Too

ChainDrop is the first npm worm to explicitly target AI developer tooling credentials. Beyond the usual credential stores, the stealer reads .claude, .cursor, .openai, and .anthropic auth directories. It then plants persistence hooks in two places: .claude/settings.json (which triggers the payload every time Claude Code starts a session) and .vscode/tasks.json (which triggers it when you open a project folder in VS Code). These hooks survive npm uninstall. Removing the package does not remove the persistence.

The Dangerous Mistake: Rotating Credentials First

The worm installs a background daemon at ~/.local/bin/gh-token-monitor.sh that watches for npm and GitHub token revocation events. If it detects a token being revoked, it immediately executes rm -rf ~/ — wiping source code, SSH keys, cloud credentials, and anything else in the home directory.

Standard incident response says rotate credentials the moment you know you’re compromised. ChainDrop was designed to punish exactly that instinct. Rotating first means the wiper runs first.

What to Do — In the Right Order

The correct remediation sequence matters more than the individual steps:

# Step 1: Remove the revocation wiper BEFORE touching credentials
rm -f ~/.local/bin/gh-token-monitor.sh
# Remove associated service or LaunchAgent for your OS

# Step 2: Clean persistence hooks
# Review and scrub .claude/settings.json
# Review and scrub .vscode/tasks.json

# Step 3: Reinstall with install scripts disabled
npm install --ignore-scripts

# Step 4: Check installed versions
npm ls keyv flat-cache file-entry-cache

# Step 5: NOW rotate credentials (from a clean environment)
# Rotate: npm token, GitHub PAT, AWS credentials,
# Kubernetes service accounts, SSH keys

Safe versions to pin: keyv@5.6.0, flat-cache@6.1.23, cache-manager@7.2.9. Wiz Research maintains a full list of confirmed malicious versions on their public GitHub. Socket.dev’s advisory also tracks affected package namespaces in real time.

What This Breaks About Supply Chain Security

SLSA provenance passed. The packages were signed by GitHub Actions. This attack did not break integrity verification — it compromised the source. The lesson is not “SLSA is useless,” but “SLSA only verifies that the build system produced what the repository contained.” If the repository is compromised, provenance signatures add false confidence.

What actually would have caught this: outbound network monitoring for Bun runtime downloads during npm install, anomaly detection on npm publish rates per token, and runtime blocking of preinstall scripts in CI. Pin your dependencies. Audit your lockfiles against known-bad version lists. And stop trusting provenance alone.