ChainDrop infects 1,300 npm packages and 2 billion monthly downloads

On August 4, 2026, BleepingComputer and multiple security teams documented ChainDrop, a supply-chain attack of rare scale on the npm ecosystem. Within hours, a threat actor compromised a key maintainer’s GitHub account, injected self-propagating malicious code into their packages, and watched the contamination cascade through the dependency graph.

The provisional toll as of 15:00 UTC on the day of discovery: over 1,300 packages infected, representing a combined 2 billion monthly downloads.

The entry vector: one maintainer, seven packages

The attack began with the compromise of the GitHub account belonging to the maintainer of Keyv, a key-value storage library for Node.js used by millions of projects.

That maintainer owned seven interconnected packages:

• Keyv — the primary key-value store (~800 million monthly downloads)
• Cacheable — cache abstraction layer
• flat-cache — serialized disk cache
• file-entry-cache — file metadata cache
• Three connector packages (Keyv Postgres, Keyv SQLite, Keyv Redis)

The attacker published compromised versions of each, embedding a malicious postinstall script that executes automatically when any dependent project runs npm install.

The self-propagation mechanism

ChainDrop doesn’t stop at infecting projects that directly depend on Keyv. The malware includes a two-stage self-propagation routine:

1. Local node_modules scan: the postinstall script walks the node_modules tree looking for other packages whose maintainer uses the same npm token stored in the local .npmrc.
2. Chain republishing: if it finds a valid authentication token, the malware republishes a compromised version of the corresponding package to the npm registry — carrying the same payload.

That mechanism turned an initial compromise of seven packages into a cascade of over 1,300 infected packages.

Among the organizations whose internal packages were contaminated by rebound:

• Deliveroo — London-listed food delivery platform
• Ornikar — French online driving school
• Qlik — BI and data integration software vendor
• Picsart — creative platform
• ServiceTitan — service management software
• OneReach — conversational automation platform

What the payload does

The injected malicious code serves three functions:

• Credential exfiltration: it collects environment variables, .env files, private SSH keys, and cloud service tokens, then exfiltrates them to a command-and-control (C2) server.
• Persistence: it modifies the infected project’s package.json to ensure the compromised version is reinstalled on every npm ci or npm install.
• Propagation: the node_modules scan and automatic republishing described above.

The C2 server was hosted behind a legitimate CDN, complicating blocking efforts by security teams.

GitHub and npm’s response

GitHub (which has owned npm since 2020) responded in multiple waves on August 4:

• Mass token revocation: all npm tokens associated with compromised accounts were automatically revoked.
• Targeted unpublish: the compromised versions of the seven initial packages were removed from the registry.
• Maintainer notification: GitHub notified the owners of all 1,300 affected packages via the email address associated with their account.
• Post-mortem investigation: GitHub’s security team launched an investigation into the initial GitHub account compromise method.

At 17:00 UTC, the npm registry temporarily blocked new version publications for packages exceeding one million monthly downloads — an emergency measure unprecedented since the colors.js/faker.js incident of 2022.

The shadow of the colors.js incident

ChainDrop is not the npm ecosystem’s first major crisis, but it surpasses all previous ones in both scale and mechanism.

In January 2022, the maintainer of colors.js and faker.js intentionally introduced an infinite loop in his packages to protest the lack of open-source maintainer compensation. A few months later, the IconBurst attack compromised around thirty packages through typosquatting.

ChainDrop combines both worst-case properties: a genuine maintainer account compromise and automatic propagation. This is no longer a disgruntled developer sabotaging their own package — it’s an attacker weaponizing the dependency graph as a propagation vector.

How to check if you’re affected

# Check whether your dependencies include the initial packages
npm ls keyv cacheable flat-cache file-entry-cache keyv-postgres keyv-sqlite keyv-redis 2>/dev/null

# Check installed versions — any version published on August 4, 2026 is suspect
npm outdated

# Audit postinstall scripts across your dependency tree
grep -r "postinstall" node_modules/*/package.json | grep -v '"postinstall": ""'

The Socket project has released a dedicated detection package:

npx @socketsecurity/chaindrop-detect

Verdict

ChainDrop is the most extensive supply-chain attack ever observed on a public package registry. It is no accident: it methodically exploits npm’s two structural weaknesses — the privilege of postinstall scripts and the unbounded transitive trust in the dependency graph.

If your project uses Keyv or any of its satellites, update to the latest uncompromised version immediately. If your project was infected by rebound, rotate all exposed keys and tokens — the attacker had a window of at least six hours to harvest credentials before the mass revocation.

Longer-term, two remedies: mandatory package signing, and disabling automatic lifecycle script execution by default. The npm manifest has allowed them forever. ChainDrop proves that is no longer tenable.

References

• BleepingComputer — Massive ChainDrop npm supply-chain attack infects hundreds of packages, August 4, 2026
• GitHub Security Advisory — ChainDrop incident, August 4, 2026
• Socket — ChainDrop detection tool, August 4, 2026