"at least 868 packages (across 1381 versions) have been compromised by the worm," Aikido researchers warned — and the count is still changing.
Scope: hundreds to more than 1,300 npm packages and huge reach
Security firms report a sprawling supply‑chain infection on the npm registry. Self‑propagating malware named ChainDrop has compromised packages that collectively account for roughly 2 billion monthly downloads, with reporting describing "more than 1,300 packages" affected. Aikido — one of the companies tracking the incident — reported "at least 868 packages (across 1381 versions) have been compromised by the worm." The compromise touched widely used caching utilities maintained by the same author, including Keyv, Cacheable, flat-cache and file-entry-cache, and spread into projects associated with organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.
Mechanics: preinstall hook, a downloaded runtime, and an obfuscated infostealer
The poisoned npm releases contained two files: setup.mjs (the payload dropper) and Math_Symbol.js (the infostealer). Affected package.json files included a "preinstall": "node setup.mjs" entry so that "anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed," Aikido said. The dropper fetches the Bun JavaScript runtime from the official GitHub release and uses it to launch the obfuscated Math_Symbol.js payload; the execution is performed with a call like:
execFileSync(<bun binary>, ['<script_dir>/Math_Symbol.js'], {{ stdio: 'inherit', cwd: <script_dir> }})
After launching the downloader runtime, setup.mjs deletes the temporary runtime directory. BleepingComputer also observed some compromised packages containing a math_init.js script instead of or in addition to Math_Symbol.js.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →Data targeted, validation, and exfiltration paths
The infostealer collects a broad set of sensitive data from developer systems and CI/CD runners. Aikido lists the data types targeted: the complete process environment, local configuration and credential files, GitHub personal access tokens and workflow tokens (ghp_, gho_, ghs_), npm tokens beginning with npm_, GitHub Actions secrets (including attempts to extract "isSecret": true values from self‑hosted runners), AWS credentials and decrypted SSM Parameter Store values, Secrets Manager secrets, Kubernetes secrets from accessible namespaces, HashiCorp Vault tokens and KV secrets, database credentials, private keys, and API credentials for services such as Stripe, Slack, Twilio, Azure, and GCP.
Every token is validated in real time against registry.npmjs[.]org/-/whoami before being exfiltrated. Aikido reported that stolen and encrypted credentials are sent to a public GitHub repository whose description reads "Shai‑Hulud: Here We Go Again." Wiz also observed a separate exfiltration domain, npm-cache[.]com, and warned it should be treated as a strong indicator of compromise.
Provenance, CI abuse, and how the worm spread
Investigators found the campaign began after the attacker compromised the GitHub account of Keyv’s maintainer and pushed malicious files directly to projects' main branches. Because the packages were built and published through the projects' legitimate GitHub Actions workflows, compromised npm releases carried valid provenance information. The malicious JavaScript is heavily obfuscated and includes self‑spreading capabilities that allow it to infect other maintainers' packages when those maintainers use a previously compromised package — effectively worming through dependency graphs.
What this means for technologists, enterprise ops, and open‑source maintainers
- Technologists and security teams: Treat any developer workstation or CI/CD runner that installed an affected package version as compromised, even if the package was later removed. Aikido and Wiz recommend rebuilding systems from safe backups or from scratch, rotating all accessible tokens, and reviewing logs for unauthorized access and unexpected commits.
- Enterprise operations and incident responders: Expect contaminated releases to show valid provenance if built through legitimate GitHub Actions workflows; provenance alone cannot be taken as proof of trust in this incident. Use dependency allowlisting, integrity checks, and provenance controls as additional layers while reviewing lists of compromised packages and IoCs published by vendors.
- Open‑source maintainers: The campaign demonstrates how a single compromised account — here, Keyv’s maintainer — can enable a worm to push malicious changes directly to main branches and trigger new releases. Maintain strict controls on access to source and CI secrets and monitor for unexpected branch changes and publish activity.
The incident remains active and the set of affected packages and versions is expected to grow. Security firms Wiz, StepSecurity, Aikido, Socket, and Ox Security have published lists of compromised packages and indicators of compromise, including file hashes and network artifacts. Organizations that depend on npm packages should consult those resources, rotate exposed tokens, and assume contaminated build environments require full remediation.
