A worm tore through npm by making the malware look perfectly legitimate

A self-spreading worm tore through npm on Tuesday. It poisoned hundreds of packages that huge swathes of the software world quietly rely on. Researchers named it ChainDrop. It is a bigger, meaner descendant of the smaller Shai-Hulud attack that hit the registry earlier this summer.

It began by hijacking the GitHub account of the developer behind keyv. That caching library is pulled in about 150 million times a week. From there it spread to its sibling packages, then to hundreds of others. Within two hours it had reached corporate names like Deliveroo, Qlik, Picsart and ServiceTitan. The affected packages draw billions of downloads a month.

The exact tally kept climbing, and researchers’ counts differed. The firms tracking it included BleepingComputer, Aikido and StepSecurity. They put the damage at hundreds of packages and well over 1,300 poisoned versions. npm has been hit before. This was among the largest.

It weaponised the industry’s own trust signals

Here is what made it dangerous. The attacker did not steal a token and upload the malware by hand. He pushed poisoned code into the projects’ main branches. Then he let each project’s own automated release pipeline publish it.

The malware shipped through legitimate GitHub Actions workflows. So every poisoned version carried valid provenance. That is the cryptographic attestation meant to vouch for a clean build. Any tool that checks for it waved the packages straight through. “Provenance proves which commit was built,” StepSecurity noted, but “it cannot prove the commit was authorised.”

The rest ran on autopilot. Each poisoned package added a preinstall hook, so a plain “npm install” quietly ran a dropper. The dropper downloaded the real Bun runtime from GitHub and used it to launch a heavily obfuscated credential-stealer. Every network request pointed at github.com, so nothing looked out of place.

What it takes, and where it hides

The payload is a vacuum. It harvested npm and GitHub tokens, plus cloud secrets from AWS, Kubernetes and Vault. It grabbed SSH and private keys, and database and Slack credentials. On GitHub Actions runners it dumped the machine’s memory to steal the job’s secrets. New this time, it also hunted AI-tool credentials, reading config files for Claude Code, Cursor, Codex, OpenAI and Gemini.

Then it spread itself. Using the npm tokens it stole, it repackaged and republished trojanised versions of every package each victim could publish. One infected laptop or build server seeded the next. That loop is what makes it a worm rather than a one-off breach.

Two touches make it hard to kill. It resolves its command server from a smart contract on the Ethereum blockchain. There is no fixed address to block or seize.

It also plants persistence in AI coding tools. It adds a Claude Code start-up hook and a VS Code task that runs when a folder opens. Simply opening an infected repository in those tools re-runs the malware, with no install required.

npm began pulling the poisoned versions within about two hours, and keyv reverted to a safe release. The researchers’ advice is blunt. Anyone who installed an affected version should treat the machine as compromised and rotate every credential. But remove the malware’s token watcher first. It fires an attacker payload the moment you revoke a stolen token.

The cheap fix that would have stopped most of this is dull. Install with scripts disabled, and wait a few days before trusting a brand-new version. It is the lesson the ecosystem keeps relearning, at a bigger scale each time.