ChainDrop: The Mini Shai Hulud npm worm’s latest wave hits keyv and cacheable

TL;DR

• Attackers compromised the GitHub account of a maintainer behind keyv, cacheable, flat-cache, and file-entry-cache. Those Node.js utility packages pull a combined billion-plus downloads a month, and the malicious code went straight to the main branch.
• A hidden preinstall script (setup.mjs) drops a Bun runtime, then runs an obfuscated payload (Math_Symbol.js) that steals npm, GitHub, AWS, Kubernetes, and Vault credentials. It then uses those stolen npm tokens to reinfect other packages and keep spreading on its own.
• This is being called ChainDrop, and it’s the latest wave of the Mini Shai Hulud npm worm family. 

What happened

On August 4, 2026, attackers compromised the GitHub account of a maintainer behind several widely used Node.js utility packages, including keyv, cacheable, flat-cache, and file-entry-cache. They pushed malicious code directly to the main branch. That triggered the maintainer’s own GitHub Actions pipelines to build and publish infected versions straight to the npm registry, complete with valid digital signatures.

Once a developer or CI/CD system runs npm install on an affected package, a hidden preinstall script called setup.mjs kicks off automatically. To dodge detection, it downloads a temporary Bun runtime executable, which then runs a heavily obfuscated payload named Math_Symbol.js.

That payload is an aggressive credential harvester. It dumps GitHub Actions runner memory to capture temporary publishing tokens. It parses local config files for npm and GitHub credentials, and scans system environments for AWS keys, Kubernetes secrets, and vault access tokens.

It also crawls local disks for SSH keys, .env files, database connection strings, and API keys for services like Slack and Stripe. Stolen credentials get encrypted and sent to attacker-controlled GitHub repositories and Ethereum smart contracts. Then the worm uses any freshly stolen npm credentials to publish backdoored updates to other packages the victim owns. That’s how it keeps spreading across the open-source ecosystem on its own.

Security researchers are tracking this as ChainDrop, and the payload traces back to the Shai Hulud malware family. It’s the same lineage behind the Mini Shai Hulud campaign that hit TanStack, Mistral AI, and OpenSearch packages in May. Different maintainer, different packages, same self-propagating playbook.

Why it matters

Keyv, cacheable, and their dependents are foundational plumbing for thousands of Node.js projects. The malicious code runs automatically during a routine npm install. A normal build or dependency update is enough to trigger a compromise, with no phishing click or social engineering required.

If an affected package lands in your environment, the exposure isn’t limited to your codebase. It extends to your cloud infrastructure, source control, and production secrets. And because the worm self-propagates using stolen credentials, one compromised maintainer account can cascade into hundreds of poisoned packages fast.

What to do right now

• Audit your lockfiles. Scan projects, CI/CD pipelines, and local environments for references to affected package versions in package-lock.json, yarn.lock, or pnpm-lock.yaml. Revert to known clean versions or pin dependencies.
• Rotate credentials immediately. Revoke and reissue any secrets present on a host or CI/CD runner where a compromised package was installed. That includes npm auth tokens, GitHub PATs and OIDC tokens, AWS access keys, vault tokens, and Kubernetes service account tokens.
• Audit CI/CD and registry activity. Check GitHub Actions logs and npm publishing logs for unauthorized builds or releases tied to your maintainer accounts.

What we’re still tracking

Expel’s threat intel team is compiling IOCs and additional technical detail tied to this campaign as the incident develops. We’ll update this post once that’s confirmed. In the meantime, the security research community has published early findings worth watching, including from Wiz, Aikido, and StepSecurity.

We’ve covered this playbook before. Our team broke down the earlier wave in Mini Shai Hulud: cross-ecosystem supply chain worm targeting npm & PyPI—it’s worth a read for the fuller pattern of how this worm family spreads and persists.

Indicators of compromise (IOCs)

Domains:

• npm-cache[.]com
• pypi-get[.]com
• js-mirror[.]com

Frequently asked questions (FAQs)

What is the ChainDrop npm supply chain attack? 

ChainDrop is a self-propagating npm worm that compromised keyv, cacheable, and their dependent packages starting August 4, 2026. Attackers took over a maintainer’s GitHub account, pushed malicious code to the main branch, and let a preinstall script steal npm, GitHub, cloud, and CI/CD credentials on every npm install.

Which packages were affected by the keyv and cacheable compromise? 

Confirmed affected packages include keyv, cacheable, flat-cache, and file-entry-cache, along with hundreds of downstream dependents. The list is still growing as researchers investigate, so check your lockfiles against the latest published package and version list rather than a single snapshot.

Is ChainDrop related to the Shai-Hulud npm worm? 

Yes. Security researchers trace the ChainDrop payload back to the Shai Hulud malware family, the same lineage behind the Mini Shai Hulud campaign that hit TanStack, Mistral AI, and OpenSearch packages in May 2026. The maintainer and packages differ, but the self-propagation method is the same.

What should I do if I installed an affected package? 

Rotate every credential reachable from the affected host or CI/CD runner, including npm tokens, GitHub PATs, AWS keys, Vault tokens, and Kubernetes service account tokens. Then audit your GitHub Actions and npm publishing logs for any unauthorized builds or releases.