Cybersecurity

Rotate Every CI Credential You Used on 4 August

A worm called ChainDrop poisoned 435 npm packages with 1,557 versions in a 124 minute window on 4 August. The libraries with the widest reach are caching helpers almost nobody installs on purpose.

CybersecurityBy Servola Tech Desk2026-08-044 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Rotate Every CI Credential You Used on 4 August

Key takeaways

ChainDrop poisoned 435 npm packages with 1,557 versions between 09:40 and 11:44 UTC on 4 August, and the six worst hit libraries drew about 1.95 billion downloads in the 30 days before the attack, so exposure follows your build pipeline rather than the dependency list you chose.
Rotate every credential a build runner could reach if you installed dependencies on 4 August: npm tokens, cloud keys, GitHub tokens, SSH keys, Kubernetes and Terraform credentials.
Check the .claude and .vscode directories on developer machines, because the payload wrote persistence into editor and AI assistant configuration and not only into CI.
flat-cache and file-entry-cache took 579.8 million and 571.2 million downloads in the 30 days to 3 August, and almost nobody installs either on purpose, so a review of what you chose would not have found them.
Under NIS2 supply chain security sits with management rather than the security team, so record which credentials you rotated and when, because that document is the finding.

What shipped between 09:35 and 11:44 UTC

The first poisoned release was keyv version 6.0.0, published at 09:35 UTC on 4 August. Semgrep, which named the campaign ChainDrop, counted 1,557 malicious versions across 435 packages in the burst that followed, between 09:40 and 11:44 UTC. Wiz, tracking the same incident, put the figure at more than 400 distinct packages and traced it to a maintainer account whose credentials had been taken. These were not typosquats and they were not new packages. They were the real libraries, republished under the real maintainer's name, with an extra file attached.

The spread crossed organisational boundaries within half an hour. Affected scopes included @deliveroo, @ornikar, @qlik, @servicetitan, @onereach, @or-sdk, @arv-bedrock and @adminide-stack, alongside the keyv and cacheable families themselves. Those organisations share no code and no ownership. What they shared was a stolen publishing token: each infection harvested npm credentials from the machine that installed the package, then used them to republish whatever else that token could reach. That is what makes this a worm rather than a single poisoned release.

The carriers are packages nobody chose

We pulled download counts from the npm registry for the 30 days ending 3 August, the day before the compromise. keyv drew 619.7 million downloads. flat-cache drew 579.8 million. file-entry-cache drew 571.2 million. cacheable-request drew 137.0 million, cacheable 30.1 million and cache-manager 16.3 million. Those six libraries together account for roughly 1.95 billion downloads in the month before they were poisoned.

Almost nobody installs flat-cache or file-entry-cache deliberately. They are caching helpers that arrive underneath linting and build tooling, several levels down a dependency tree, in projects whose owners have never typed either name. That is the uncomfortable part of the arithmetic. The packages with the largest blast radius are precisely the ones absent from the dependency list you reviewed and approved, so auditing your own choices tells you very little about this incident. The number that predicts your exposure is how many times your build ran on 4 August.

The payload went looking for the AI assistant

The mechanism was a preinstall hook, which matters because it runs during dependency resolution and does not wait for your code to import anything. The loader files, setup.mjs and math_init.js, downloaded a standalone Bun runtime and executed an obfuscated second stage. Wiz identified the traffic by its user agent, Bun/1.3.13. The harvester went after npm tokens, cloud credentials, SSH keys, CI secrets, cryptocurrency wallets and AI configuration files.

It also wrote persistence into the .claude and .vscode directories, which is a deliberate choice about where developers now keep trust. An editor and an AI assistant hold repository access, shell permission and, increasingly, the authority to run commands. Command and control was hidden in an Ethereum smart contract, read with an eth_call and returning the domain npm-cache[.]com, so the operators can repoint their infrastructure without shipping new malware. Exfiltration went into GitHub repositories created under the compromised identities and labelled Shai-Hulud: Here We Go Again, naming the malware family this payload descends from.

Two hours is long enough to be a NIS2 finding

For an operator in the EU or the UK the compliance question is not only whether you were breached but whether you can describe what happened. Two of the affected scopes belong to Deliveroo and Ornikar, a UK delivery platform and a French driving school company. Neither is an obscure shop and neither chose to be part of this incident. NIS2 places supply chain security with management rather than with the security team, and DORA asks financial entities for the same evidence about third party ICT risk.

So the record matters as much as the remediation. Establish whether any build ran between 09:35 and roughly 15:00 UTC on 4 August, the point at which the Ethereum command and control channel was documented and analysis was still continuing. Rotate every credential a runner could reach, not only the npm token: cloud keys, GitHub tokens, SSH keys, Kubernetes and Terraform credentials. Rebuild the runners rather than cleaning them. Then write down what you rotated and when, because that document is what a regulator, an auditor or an insurer will ask for.

Frequently asked questions

How do I know whether we were affected?

Check whether any dependency install ran on 4 August between roughly 09:35 and 15:00 UTC, then compare the resolved versions in your lockfile against the published lists of malicious releases; Wiz published a machine readable list of the compromised packages. The absence of these names from your direct dependencies proves nothing, because the worst affected libraries were transitive.

Is rotating the npm token enough?

No. The harvester collected cloud credentials, SSH keys, CI secrets, Kubernetes and Terraform credentials and cryptocurrency wallets from any machine that ran the install. Treat every secret the build runner could read as exposed and rotate all of them, and rebuild the runner rather than cleaning it, because persistence was written into editor and AI assistant directories.

Why does the Ethereum contract matter?

It removes the usual takedown route. Rather than hard coding a domain, the malware read a list from a smart contract, so blocking one domain does not sever control and the operators can publish a new address without shipping new code. Defenders have to filter on behaviour, such as an unexpected Bun runtime download during a build, rather than on a fixed indicator.

Dependency review is not the control that would have caught this. The two libraries with the widest reach were ones almost nobody put in a manifest, and the payload ran before a single line of application code executed. The control that works is narrower: short lived credentials inside the build, provenance checks at install time, and a list of what your runners can reach that is short enough to rotate in an afternoon.

npmChainDropShai-HuludSupply chain securityNIS2CI/CDCredential rotation

Nobody Can Verify The Chip In Your Security Key

On 6 August the DEF CON badge ships with Baochip-1x, a 22nm part built so the silicon can be checked with infrared light. Every root of trust you already own cannot be checked at all.

6 min read

Cybersecurity

Clearing the Attacker Also Clears Your Logic

The FBI and CISA both tell water operators to wipe the controller and restore a clean image. That instruction only works if someone can still produce the program file - and in most European plants the integrator holds it, not the operator.

6 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles