Breaking: npm Supply Chain Attack Hits 434+ Packages With 2 Billion Monthly Downloads

On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv, a key-value storage library with roughly 127 million weekly npm downloads. From there, the attack cascaded across the maintainer's entire package family and beyond, reaching 434 packages across 1,381 versions with a combined 2 billion monthly downloads. The security community is calling the malware "ChainDrop," and it follows the "Mini Shai-Hulud" worm pattern first documented earlier this year.

What Is Keyv?

Keyv is a simple key-value store for Node.js with pluggable storage adapters. It supports Redis, MongoDB, SQLite, PostgreSQL, MySQL, and plain file storage. Developers use it for session storage, caching, feature flags, and any scenario where lightweight persistent key-value access is needed. The package has 127 million weekly downloads and over 7 million dependent packages.

The same maintainer, jaredwray, owns several other widely-used caching utilities:

• cacheable - 29 million monthly downloads, a caching wrapper built on top of keyv
• flat-cache - 565 million monthly downloads, a flat-file caching module used by ESLint and thousands of build tools
• file-entry-cache - 557 million monthly downloads, a file metadata cache used by linting tools to skip unchanged files

When the attacker gained control of the maintainer's GitHub account, they could publish new versions to all of these packages simultaneously. The npm registry trusts whoever holds the publishing token, regardless of whether the publisher is the legitimate owner.

How the Attack Works

The malicious versions add a preinstall hook (setup.mjs) that runs automatically when a developer or CI pipeline runs npm install. This hook:

1. Downloads a standalone Bun runtime to avoid depending on the host Node.js environment.
2. Executes an obfuscated second-stage payload that harvests credentials from the environment.
3. Targets cloud and CI credentials including AWS, HashiCorp Vault, Kubernetes, Google Cloud, Azure, npm, and GitHub Actions tokens.
4. Uses stolen npm tokens to self-propagate, publishing trojanized versions of other packages the token can reach. This is the worm behavior that turned a single compromised account into 434 affected packages.

The compiled library code remains untouched. The malicious files are additive: a preinstall hook and two extra files in the package tarball. This means the packages still work normally, making the compromise harder to detect through functional testing.

The GitHub OIDC Angle

According to Mend.io's analysis, the second-stage payload also exploits GitHub Actions OIDC token exchange. In workflows that use OIDC for cloud authentication, the attacker can exchange the OIDC token for short-lived cloud credentials without needing long-lived secrets. This turns any CI pipeline that installs the compromised packages into a credential exfiltration endpoint.

Scale and Impact

The numbers here are staggering:

• 434 packages compromised across 1,381 versions
• 2 billion monthly downloads combined across affected packages
• Packages from organizations including Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan were swept into the attack
• Snyk identified 11 malicious releases carrying the same two payload files, with 8 still tagged as latest at 11:16 UTC on August 4

flat-cache alone has 565 million monthly downloads and is a transitive dependency of ESLint, the most widely used JavaScript linter. Any project that ran npm install or npm ci during the window the malicious versions were live could have triggered the preinstall hook.

What to Do Right Now

If you installed any keyv, cacheable, flat-cache, or file-entry-cache packages today, take these steps immediately:

1. Check your lockfile for versions published on August 4, 2026. The malicious keyv version was 6.0.0.
2. Rotate all credentials that were present in the environment during install: AWS keys, GCP service account keys, Azure tokens, HashiCorp Vault tokens, npm tokens, GitHub Actions secrets, and Kubernetes service account tokens.
3. Audit your npm publish tokens. If any were stored in the environment, assume they were stolen and revoke them.
4. Check your package registry for any unexpected new versions of packages you maintain. The worm republishes trojanized versions using stolen tokens.
5. Pin to known-good versions using npm ci with a lockfile that predates August 4, 2026.

Indicators of Compromise

• Presence of setup.mjs in package tarballs
• A preinstall script in package.json referencing setup.mjs
• Downloads of a standalone Bun runtime from non-standard URLs during npm install
• Network connections to unknown endpoints during package installation
• Unexpected new versions of your own packages on npm
• [email protected] in your lockfile (this is the malicious version)

Advisory References

Snyk has published advisory SNYK-JS-KEYV-18515941, classifying [email protected] as embedded malicious code under CWE-506. Socket, Aikido, and Mend.io are all tracking the incident and updating their package lists in real time as new compromised packages are discovered.

What This Means for the Ecosystem

This attack demonstrates a pattern that is becoming common in the npm ecosystem: compromise a single high-value maintainer account, inject a self-propagating payload, and let the worm do the rest. The "Mini Shai-Hulud" family of malware was first documented earlier in 2026, and ChainDrop is its largest deployment yet.

The root cause is the same as every major npm supply chain attack: trusted publishing credentials stored in a single GitHub account, with no multi-factor authentication or publish-time verification. Until the ecosystem adopts mandatory 2FA for high-impact maintainers and cryptographic package signing, these attacks will continue to scale.

Updated August 4, 2026. This is a developing story. The package count was 434 at time of writing and may grow.