# ChainDrop Worm Infiltrates Hundreds of npm Packages, Threatens Billions of Installs

*Published August 7, 2026*
*Source: [https://www.infosecurity-magazine.com/news/chaindrop-worm-400-npm-two-billion/](https://www.infosecurity-magazine.com/news/chaindrop-worm-400-npm-two-billion/)*

## Executive Summary

The ChainDrop worm has compromised over 430 npm packages, affecting more than two billion installs. This attack highlights the need for organizations to be vigilant about potential credential breaches even if they do not use the affected packages directly.

## Article

A significant security breach has been identified involving the ChainDrop campaign, which has affected over 430 npm packages. These compromised packages collectively account for more than two billion monthly installs. The attack began on August 4 when the GitHub account of the maintainer of the popular keyv key storage library was compromised. This library alone boasts approximately 127 million weekly downloads. Using this access, attackers injected a credential-stealing worm into various other packages, such as cacheable, flat-cache, and file-entry-cache, significantly impacting their security. 

The attack involved pushing malicious files directly to the main branch of these projects and immediately releasing new versions. This allowed the infected versions to be published to npm with valid GitHub Actions signatures, ensuring their distribution across the platform. The malicious packages are equipped with an infostealer designed to collect sensitive information, including npm and GitHub tokens, AWS credentials, Kubernetes secrets, HashiCorp Vault tokens, and Stripe and Slack tokens. This data is then encrypted and sent to a public GitHub repository, ominously titled "Shai-Hulud: Here We Go Again." 

The worm-like features of ChainDrop enable it to propagate to other maintainers and repositories by exploiting the stolen tokens. Companies such as Deliveroo, Ornikar, OneReach, Picsart, and Qlik have been mentioned as victims of this campaign. Microsoft and Wiz Security have also released analyses of the campaign, providing indicators of compromise and mitigation advice. According to Katie-Paxton Fear, a staff security advocate at Semgrep, this campaign mimics previous Shai-Hulud attacks by stealing developer credentials to compromise additional packages. 

Organizations are advised to remain vigilant even if they do not use the affected packages directly. There is a need to rotate exposed secrets, scrutinize logs for unauthorized access, and audit internal packages for signs of infection.