At 09:35 UTC on August 4, 2026, a new version of the popular npm package keyv — a key-value storage abstraction library — was published carrying a malicious preinstall script, according to threat research firm ThreatPaper. Elastic Security Labs and Unit 42 both identified the incident as part of the broader Shai-Hulud family of npm supply-chain worms and gave the specific payload the name CHAINDROP.
Security firm StepSecurity, which tracked the incident in real time, reported that the worm infected 444 packages and 2,212 versions in under four hours, starting from the single compromised keyv release. Because keyv and its sibling package cacheable are dependencies of many other widely used libraries, Elastic estimated the combined blast radius at packages totaling over 1.3 billion monthly downloads.
Why it matters
Caching libraries like keyv sit deep in the dependency tree of countless JavaScript applications, meaning most developers who were affected never directly chose to install it — it arrived as a transitive dependency of something else. That makes this exactly the kind of attack that is nearly impossible to prevent through manual vetting, because organizations cannot realistically audit every package their direct dependencies pull in.
The worm's self-propagating design is also significant: rather than a single one-off malicious release, CHAINDROP automatically used stolen npm publishing credentials to infect other packages the compromised maintainer had access to, then repeated the process from those packages' own maintainer accounts where possible — the same pattern researchers first documented in the original Shai-Hulud campaign.
How it works
Phoenix Security's writeup describes the mechanism plainly: an attacker took over the GitHub account behind keyv and the cacheable family of libraries, then published keyv@6.0.0 with a malicious preinstall hook that runs automatically the moment the package is installed, without any action required from the developer. StepSecurity's analysis adds that the payload was Bun-loaded and harvested CI/CD credentials, with command-and-control communication routed through an Ethereum-based dead-drop mechanism. Unit 42 confirmed the worm's goal was to expose developer workstations and continuous integration systems by stealing stored credentials and tokens. This report omits any reproduction steps for the payload itself.
Evidence
Multiple independent security research teams — Elastic Security Labs, Unit 42, StepSecurity, Phoenix Security, ThreatPaper and Aikido — published corroborating technical analyses of the same incident within days of the August 4, 2026 compromise, each identifying keyv@6.0.0 as the initial infected release. As of these reports, no CVE identifier had been assigned to the incident, which researchers attribute to a supply-chain account compromise rather than a code vulnerability.
What defenders should do
Any organization that ran npm install against keyv, cacheable, or their dependents between August 4 and the point malicious versions were pulled should treat CI/CD credentials, cloud access keys and npm publishing tokens on affected machines as compromised and rotate them. Teams should audit their lockfiles for the specific malicious version ranges identified by Elastic and StepSecurity, pin dependencies rather than accepting automatic minor-version updates for critical packages, and consider requiring provenance attestation and two-factor publishing on any packages they themselves maintain.
What happens next
This is at least the second large Shai-Hulud-style worm campaign against the npm ecosystem in 2026, following an earlier wave researchers dubbed "Mini Shai-Hulud" that hit the OpenAPI React Query Codegen package in late August. Expect npm and package-registry operators to face renewed pressure to mandate stronger publishing security — such as hardware-token-backed two-factor authentication for maintainers of high-download packages — and for more affected downstream projects to surface as researchers continue tracing the worm's propagation.