A self-propagating worm named ChainDrop infected more than 400 npm packages, including keyv, flat-cache and cache-manager, Microsoft reported on 4 August 2026. The malware steals developer and cloud credentials, then uses stolen publishing tokens to poison further packages on its own. For third-party risk teams, it is a fourth-party exposure most vendor registers never capture.
A self-propagating worm has infected more than 400 npm packages, the shared building blocks that sit inside millions of JavaScript projects. Microsoft Threat Intelligence, which named the campaign ChainDrop, reported on 4 August 2026 that the malware steals developer and cloud credentials, then uses those stolen keys to publish poisoned versions of still more packages on its own. Affected code includes widely used utilities such as keyv, flat-cache and cache-manager. Any organisation whose developers or build systems installed a bad version may have leaked npm, GitHub, cloud and secret-store credentials. The lesson: one open-source dependency, compromised at the source, can reach every secret downstream.
What happened
Microsoft published its analysis on 4 August 2026 and updated it on 5 August. It attributes the initial compromise to stolen maintainer credentials, not a flaw in npm itself (npm is the main registry for JavaScript code). The malicious releases carry a variant of the Shai-Hulud worm, delivered as a large, obfuscated payload that runs through an npm preinstall hook, meaning it fires automatically before installation finishes. Once running, it searches developer workstations and continuous-integration systems for npm, GitHub, Amazon Web Services, Kubernetes and HashiCorp Vault credentials (Vault is a common secrets store). It validates the stolen keys against each service, harvests further secrets, and encrypts the results to an attacker-controlled server. The worm's defining trait is automated spread: with a stolen npm publishing token it downloads a package's latest version, inserts itself, bumps the patch number and republishes, turning one compromised account into many poisoned releases. Some packages were republished through GitHub Actions trusted-publisher workflows, so the tampered versions carried valid provenance signatures. Security firms including Aikido counted at least 444 packages across more than 1,300 versions; Microsoft confirms more than 400. The affected utilities are among the most installed in the JavaScript ecosystem, with reported downloads running into the billions of installs a month across the family.
Why it matters for third-party risk
This is ICT supply-chain risk at its rawest: a fourth-party exposure that most vendor registers never capture. Your supplier did not have to be breached. A package three or four dependencies deep in something you bought, or built, was enough. Two features make ChainDrop worse than a one-off hijack. It propagates on its own, so the list of affected packages grew by the hour rather than staying fixed. And it produced releases with valid provenance, the cryptographic proof that a package came from a legitimate pipeline, which undercuts a control many teams treat as a green light. Concentration is the quiet risk here: a small number of maintainers own utilities that sit inside a very large share of the JavaScript ecosystem, so one account takeover reaches far.
What teams should take from it
Treat your dependency tree, including transitive dependencies, as part of your supplier estate and inventory it accordingly. Pin known-good versions, delay adopting brand-new releases (npm's min-release-age setting helps), and disable install scripts where you can. If a build or workstation pulled an affected version, rotate every credential it could reach from a clean machine, not the infected one, and check continuous-integration caches and shared build images, which can silently carry the poisoned files forward. Do not treat a valid provenance signature as proof of safety this week.
For teams working out which of their software dependencies and vendors could carry this kind of fourth-party risk, see how continuous vendor and dependency monitoring works.
FAQ
What is ChainDrop?
ChainDrop is the name Microsoft Threat Intelligence gave to a large-scale npm supply-chain attack disclosed on 4 August 2026. A self-propagating worm, a variant of the Shai-Hulud malware, infected more than 400 JavaScript packages, stole developer and cloud credentials, and used stolen publishing tokens to spread to further packages automatically.
How do I know if my organisation is affected?
Review dependency trees, lockfiles, artifact repositories and CI caches for affected package versions, including transitive references you did not add directly. Microsoft has published package hashes and indicators of compromise. Any workstation or build runner that installed a bad version should be treated as potentially compromised, and its reachable credentials rotated from a clean host.
Does a valid provenance signature mean a package is safe?
Not in this case. Some poisoned versions were republished through GitHub Actions trusted-publisher workflows, so they carried valid provenance. Provenance shows where a release was built, not that its contents are trustworthy. Pin known-good versions and verify against published indicators rather than relying on the signature alone.
Want this applied to your supplier ecosystem? See the platform in action and map your top vendor risks live in one walkthrough.
