On 4 August 2026, someone took over the GitHub account of the developer behind keyv, a small caching library pulled into projects around 150 million times a week, along with a family of related packages he also maintains — cacheable, flat-cache, file-entry-cache, cache-manager and others. They pushed malicious code and published new versions carrying a self-propagating worm researchers are calling ChainDrop, a bigger successor to the "Shai-Hulud" npm worm that hit the registry earlier this year. The trigger sat in a preinstall script that fired the moment a developer or a build server ran npm install: it quietly downloaded a JavaScript runtime, then used it to run a 700KB obfuscated payload that scanned the machine for npm tokens, GitHub credentials, AWS and cloud keys, Kubernetes secrets, HashiCorp Vault tokens, SSH keys, .env files and more — encrypted what it found and shipped it out to attacker-controlled infrastructure. It then used any stolen publishing tokens to inject the same payload into other maintainers' packages. Within roughly half an hour the worm had spread across packages belonging to at least nine unrelated organisations; by the end of the day, independent trackers counted anywhere from several hundred to well over a thousand poisoned package versions across the ecosystem, with the eleven directly hijacked packages alone accounting for more than 2 billion combined monthly downloads.
What this means for your business
You don't need to have heard of keyv to be exposed — that's exactly the point of a dependency worm. If any part of your website, app, or internal tooling is built on Node.js, there is a real chance one of these packages sits several layers deep in your project's dependency tree without anyone on your team ever having chosen it directly. The practical response this week: have your developer or agency check your package-lock.json or yarn.lock against the published list of poisoned package names and versions, and if any build or install ran on or after 4 August, treat that build machine as compromised rather than assume the worm failed silently — rotate npm and GitHub tokens, cloud credentials, and anything sitting in environment files, and check for unfamiliar entries in .vscode/tasks.json or .claude/settings.json, which the worm also used to plant persistence. Longer term, this is a case for pinning exact dependency versions and reviewing what changes before you let anything auto-update, rather than trusting that a popular package with hundreds of millions of weekly downloads is safe by virtue of its popularity alone — popularity is precisely what made this campaign's blast radius so large, so fast.