New ChainDrop worm poisons over 1,300 npm packages, Keyv and Cacheable among those hit

Date:
Wed, 05 Aug 2026 11:05:00 +0000

Description:
Another Shai-Hulud variant hits npm packages, worming its way into hundreds
of packages.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Aikido researchers uncovers ChainDrop, a ShaiHulud variant infecting 1,300+ npm packages with an infostealer Attackers compromised GitHub accounts tied to popular libraries (Keyv, Cacheable, flatcache, fileentrycache) and pushed tainted releases with 2B monthly downloads Malware exfiltrates developer/cloud credentials and secrets to a public GitHub repo; admins should treat affected systems as compromised even after removal Another Shai-Hulud variant has been discovered in the wild, infecting more than 1,300 npm packages with an infostealer.

Security researchers Aikido reported finding at least 868 packages (across 1381 versions) that have been compromised by the worm. Shai-Hulud is a self-propagating supply chain malware that targets software developers by compromising open-source packages and CI/CD pipelines. It steals credentials, API keys, and access tokens and then uses those stolen secrets to publish additional malicious packages. Latest Videos From TechRadar Watch full video here: What to do in case of an infection In May 2026, actors claiming to be associated with the TeamPCP group publicly released the Shai-Hulud worm's source code, saying they were open sourcing the carnage and inviting other threat actors to adopt and modify the code. Since then, there were multiple copycat campaigns and variants, including this one which Aikido dubbed ChainDrop.

Aikido said the attackers compromised the GitHub account of the person maintaining Keyv and Cacheable, widely used open source JavaScript libraries for caching data in Node.js applications. From there, they were able to move into other popular utilities such as flat-cache and file-entry-cache, as well as packages associated with organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. You may like Mini Shai-Halud hackers publish over 600 compromised npm packages Compromised Red Hat npm packages downloaded over 80,000 times in one week supply chain attack still ongoing OpenAI Codex tool with over 29,000 downloads linked to malicious npm supply chain attack stealing authentication tokens

The malware was pushed directly into the projects main branches, and then generated additional package releases. The compromised packages have a combined 2 billion monthly downloads.

Aikido says the infostealer grabs developer and cloud credentials, encrypts them, and then sends them to a public GitHub repository called Shai-Hulud: Here We Go Again. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

It also steals local configuration files, GitHub PATs, workflow tokens, and other ghp_, gho_, and ghs_ tokens, certain npm tokens, GitHub Actions
secrets, AWS credentials, Kubernetes secrets, and more.

The researchers are saying system admins who installed a tainted package should treat their developer workstation or CI/CD runner as compromised, even if they removed the package. The best antivirus for all budgets Our top
picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/new-chaindrop-worm-poisons-over-1-300-n pm-packages-keyv-and-cacheable-among-those-hit


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)