A newly disclosed npm supply-chain attack called ChainDrop compromised hundreds of packages linked to the widely used Keyv and Cacheable ecosystems, exposing developers and automated build systems to credential theft. Security companies investigating the campaign on August 4 reported that malicious releases could spread through package publishing access stolen from infected environments, expanding the incident beyond its initial targets.

Keyv provides a common key-value storage interface for Node.js applications, while Cacheable packages supply caching components used across JavaScript projects. Aikido Security, Socket, StepSecurity and SafeDep separately analyzed the incident as affected versions appeared in the npm registry. The number of identified packages continued to change during the response, so researchers urged teams to rely on updated affected-version lists rather than aggregate counts.

StepSecurity found that the malware executes during package installation and uses the Bun JavaScript runtime to launch its payload. The code searches developer workstations and continuous integration environments for credentials, including npm publishing tokens and other secrets available to build jobs. Researchers said the theft of registry credentials enables the worm-like behavior by giving the malware a route to publish tainted releases under additional legitimate package names.

Investigators also reported that ChainDrop uses the Ethereum blockchain as a dead-drop mechanism to obtain command-and-control information. This design lets operators change infrastructure without embedding a conventional fixed server address in each package. The campaign targets trusted software distribution paths rather than a disclosed product vulnerability, and no CVE identifier has been assigned to the package compromise.

Maintainers and organizations should identify whether dependency lockfiles or build logs show installation of affected Keyv, Cacheable or related package versions, according to the researchers. Potentially exposed npm tokens, GitHub credentials, cloud keys and other CI/CD secrets should be revoked and rotated. Teams should also rebuild from known-clean dependencies and caches after removing malicious versions so a tainted artifact is not restored during a later build.

Defenders can reduce immediate risk by pinning exact package versions, restricting install scripts where operationally possible and limiting publishing tokens to narrowly scoped, short-lived credentials. Registry and pipeline logs should be reviewed for unexpected package publications and outbound activity from build runners. Because the affected-package inventory was still developing at publication time, organizations should continue monitoring npm and the researchers' advisories for newly confirmed versions.