erroneo.us
Search all guides⌘K

Security Digest · Aug 4, 2026 · Supply-chain compromise · Library

ChainDrop: npm Worm Trojanizes keyv and cacheable Packages

Aug 2026 Shai-Hulud variant hit 400+ npm packages (1,300+ versions) via keyv 6.0.0 and cacheable family; steals CI/cloud secrets. Check lockfiles, rotate.

Published By erroneo.us Security Desk · Updated 3 min read4 sources

Our verdict

Check exposure

These are deep transitive dependencies of ESLint-style tooling and HTTP stacks, so many projects resolved them without choosing them; if a lockfile picked up a flagged version in August 2026, treat that host as compromised.

Who must act: Any team whose lockfile, container image or CI cache contains a flagged version (e.g. keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6), or whose repos gained unexpected .claude/ or .vscode/ hook files.

Who can relax: Projects whose lockfiles never resolved a flagged version, and installs run with install scripts disabled, did not execute the payload.

Affected
keyv 6.0.0
flat-cache 6.1.24
file-entry-cache 11.1.6
cacheable-request 13.0.20
cacheable 2.5.1
cache-manager 7.2.10
@cacheable/memory 2.2.1, @cacheable/node-cache 3.1.2, @cacheable/utils 2.5.1, @cacheable/net 2.1.1
ecto 5.0.1
Hundreds more packages across unrelated publishers (see Socket/Datadog lists)
Fixed in
Malicious versions removed from npm; pin to the prior known-good version for each package
CVSS
Not scored
EPSS
n/a
CISA KEV
Not listed
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Search lockfiles, images and CI caches for flagged versions and setup.mjs / Math_*.js
  2. If a gh-token-monitor service exists, disable and remove it before revoking GitHub tokens
  3. Rotate npm, GitHub, cloud, Kubernetes, Vault, SSH and Terraform credentials from a clean machine
  4. Remove injected .claude/settings.json, .vscode/tasks.json, setup.mjs files and the codeql_analysis.yml workflow from all branches
  5. Rebuild affected hosts and runners; purge npm/yarn/pnpm caches
  6. Enforce install-script blocking and a minimum release age (npm min-release-age, pnpm minimumReleaseAge)

How to check if you are affected or compromised

  • grep -nE '"(keyv|flat-cache|file-entry-cache|cacheable-request|cacheable|cache-manager|ecto)"' -A2 package-lock.json | grep -E '6\.0\.0|6\.1\.24|11\.1\.6|13\.0\.20|2\.5\.1|7\.2\.10|5\.0\.1'
  • npm ls keyv flat-cache file-entry-cache cacheable-request cache-manager --all
  • Files: setup.mjs with SHA-256 54dc7ea5...0668 or fd3ca400...b1eb; math_init.js/Math_Symbol.js 9fc2570b...cbcc; ~/.config/gh-token-monitor/
  • Network: npm-cache[.]com, pypi-get[.]com, js-mirror[.]com, awqhnjewqjkl[.]icu (/router); GitHub repos described 'Shai-Hulud: Here We Go Again'

What happened#

On August 4, 2026, a new self-propagating npm worm, named ChainDrop, began with the keyv key-value library. Datadog's reconstruction traces it to an unsigned commit at 09:02 UTC that added setup.mjs, Math_Symbol.js and a preinstall hook to the Keyv repository. Automated commits then planted Claude Code and VS Code execution hooks on several branches. At 09:35 UTC keyv@6.0.0 shipped to npm with genuine SLSA provenance from the project's own release workflow. Within the hour, nine Cacheable-family versions and ecto@5.0.1 followed.

Microsoft calls the payload a "Mini Shai-Hulud variant" and counts more than 400 affected packages across unrelated publishers. It names no threat actor. Stolen maintainer credentials are the likely initial access. The payload spreads through stolen npm tokens and through GitHub Actions OIDC publishing, which means some malicious releases carry valid provenance.

Who is affected#

Singapore's CSA (AD-2026-009) counts more than 1,300 compromised versions with about 2 billion combined monthly downloads. It lists these notable versions: keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable-request 13.0.20, cacheable 2.5.1, cache-manager 7.2.10, @cacheable/memory 2.2.1, @cacheable/node-cache 3.1.2, @cacheable/utils 2.5.1, @cacheable/net 2.1.1, and ecto 5.0.1. Many of these are transitive. flat-cache and file-entry-cache sit under common linting toolchains, and cacheable-request sits under HTTP clients. Your project could have pulled them in without anyone adding a dependency.

Do you really need to act?#

Check first; the answer depends on the lockfile. A flagged version only reached you if a fresh resolve happened while it was live, through an npm install, a lockfile refresh, Renovate or Dependabot, or a CI job without a lockfile. If one did and install scripts ran, the payload almost certainly executed. It runs at preinstall, before your build even starts. In CI it stays attached to read job secrets. On Linux GitHub runners it reads secrets straight from Runner.Worker memory, and it can abuse toJSON(secrets) through workflows. On workstations it detaches and keeps running. In that case, assume every credential the host could reach is gone.

One trap matters for remediation order. Microsoft and Datadog describe a token-monitor component with a destructive handler that fires when the monitored GitHub token is revoked. Disable and remove it before you rotate. Also note that "has provenance" did not mean "safe" here; the attestations were real.

What to do now#

  1. Inventory: run npm ls keyv flat-cache file-entry-cache cacheable-request cache-manager ecto --all in each repo. Grep lockfiles, built images (docker run --rm IMAGE sh -c 'find / -name package.json -path "*keyv*"') and CI caches for the versions listed above. Then compare against the full Socket/Datadog lists.
  2. On any affected host, look for ~/.local/bin/gh-token-monitor.sh, ~/.config/gh-token-monitor/, ~/Library/LaunchAgents/com.user.gh-token-monitor.plist, or ~/.config/systemd/user/gh-token-monitor.service. Stop and delete them first.
  3. From a clean machine, rotate npm tokens, GitHub PATs and app keys, AWS, GCP and Azure credentials, Kubernetes configs, Vault tokens, SSH keys and Terraform credentials. Then review cloud audit logs for Secrets Manager, Parameter Store and Vault reads.
  4. Across all branches, remove injected .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json and .vscode/setup.mjs files. Also remove any codeql_analysis.yml on a dependabot/github_actions/format/setup-formatter branch.
  5. Rebuild runners and workstations. Purge npm, yarn and pnpm caches and pin known-good versions.
  6. Harden: install with --ignore-scripts in CI, and set a release-age delay (Microsoft recommends npm CLI v12 with min-release-age). Require approval for workflow-file changes.

How to tell if you were hit#

Host IOCs: setup.mjs (SHA-256 54dc7ea5…0668 or fd3ca400…b1eb), math_init.js/Math_Symbol.js (9fc2570b…cbcc), an unexpected Bun 1.3.13 download, a tmp.dpkg_14527.lock file in the temp directory, and the environment variable _NODE_RUNTIME_INIT=1. Network: POSTs to /router on npm-cache[.]com, pypi-get[.]com, js-mirror[.]com or awqhnjewqjkl[.]icu, and Ethereum RPC lookups of contract 0xE1f2395e…3103. On GitHub, look for public repos described "Shai-Hulud: Here We Go Again" containing results-*.json, and for patch-version npm releases with no matching tag or commit. Elastic and Microsoft publish hunting queries.

Timeline#

  • — Malicious commit to Keyv at 09:02 UTC; keyv 6.0.0 published at 09:35 UTC; cacheable family and ecto follow by 10:28 UTC; Microsoft and Datadog publish analyses.
  • — Datadog adds the new C2 domain awqhnjewqjkl[.]icu, pushed via the smart contract.
  • — Singapore CSA issues advisory AD-2026-009 citing 1,300+ compromised versions.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Microsoft Security Blog — ChainDrop supply chain compromise: anatomy of a self-propagating worm microsoft.com
  2. Datadog Security Labs — 'ChainDrop' worm compromises hundreds of popular npm packages securitylabs.datadoghq.com
  3. Cyber Security Agency of Singapore — AD-2026-009 Ongoing npm supply chain attack affecting Keyv csa.gov.sg
  4. Elastic Security Labs — Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages elastic.co