ChainDrop worm compromises 1,300 npm packages

A major new malware campaign has compromised hundreds of popular software packages on the npm registry, posing a severe supply chain threat to developers and organizations worldwide. Security researchers have identified the campaign, dubbed ChainDrop, as a variant of the self-propagating ShaiHulud infostealer worm. The attack, which began on August 4, 2026, has so far infected over 1,300 package versions with a combined two billion monthly downloads.

The campaign started when attackers compromised the GitHub account of a maintainer responsible for the widely used keyv key storage library, which sees roughly 127 million weekly downloads. Using that access, the threat actors injected malicious code directly into the main branches of keyv and related projects before publishing tainted releases to npm. Because these packages were built and published through legitimate GitHub Actions workflows, the compromised versions carried valid digital provenance, making them appear trustworthy.

The malicious packages include a dropper script that automatically executes during installation. This script downloads the official Bun JavaScript runtime to execute a heavily obfuscated payload designed...