--- title: A worm tore through npm by making the malware look... description: A self-spreading worm called ChainDrop compromised hundreds of npm packages by hijacking the GitHub account of the keyv library maintainer, then using the... canonical: https://daily.dev/posts/a-worm-tore-through-npm-by-making-the-malware-look-perfectly-legitimate-djxmpo5ck twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A worm tore through npm by making the malware look perfectly legitimate | daily.dev og:description: A self-spreading worm called ChainDrop compromised hundreds of npm packages by hijacking the GitHub account of the keyv library maintainer, then using the... og:url: https://daily.dev/posts/a-worm-tore-through-npm-by-making-the-malware-look-perfectly-legitimate-djxmpo5ck og:image: https://api.daily.dev/og/posts/DjxMpo5CK.png og:image:alt: A worm tore through npm by making the malware look perfectly legitimate og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A worm tore through npm by making the malware look perfectly legitimate **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 0 upvotes · 0 comments ## Summary A self-spreading worm called ChainDrop compromised hundreds of npm packages by hijacking the GitHub account of the keyv library maintainer, then using the project's own automated release pipelines to publish malicious versions with valid cryptographic provenance attestations. The malware used preinstall hooks to silently drop a credential stealer that harvested npm/GitHub tokens, cloud secrets (AWS, Kubernetes, Vault), SSH keys, database credentials, and notably AI-tool credentials for Claude Code, Cursor, Codex, OpenAI, and Gemini. It spread itself by republishing trojanized versions of every package the victim could publish, making it a true worm. Command-and-control was routed through an Ethereum smart contract to avoid takedowns, and it planted persistence hooks in AI coding tools like VS Code and Claude Code. npm pulled poisoned versions within two hours. Affected users should treat machines as compromised, rotate all credentials, and remove the token watcher before revoking stolen tokens to avoid triggering attacker payloads. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Massive ChainDrop npm supply-chain attack infects hundreds of packages](https://daily.dev/posts/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages-uhzbslfdu) · BleepingComputer · 3 upvotes · 1 comments - [New npm worm hits CI pipelines and AI coding tools](https://daily.dev/posts/new-npm-worm-hits-ci-pipelines-and-ai-coding-tools-3fx3mdyns) · InfoWorld · 0 upvotes · 0 comments - [Another npm supply chain worm hits dev environments](https://daily.dev/posts/another-npm-supply-chain-worm-hits-dev-environments-birdicj09) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/a-worm-tore-through-npm-by-making-the-malware-look-perfectly-legitimate-djxmpo5ck) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A worm tore through npm by making the malware look perfectly legitimate","url":"https://daily.dev/posts/a-worm-tore-through-npm-by-making-the-malware-look-perfectly-legitimate-djxmpo5ck","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-worm-tore-through-npm-by-making-the-malware-look-perfectly-legitimate-djxmpo5ck"},"datePublished":"2026-08-04T17:26:59.385Z","dateModified":"2026-08-05T02:09:06.407Z","description":"A self-spreading worm called ChainDrop compromised hundreds of npm packages by hijacking the GitHub account of the keyv library maintainer, then using the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ec73fa4f7d5fb97a2b51542c2fcc04ed?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ec73fa4f7d5fb97a2b51542c2fcc04ed?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-worm-tore-through-npm-by-making-the-malware-look-perfectly-legitimate-djxmpo5ck","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware,github-actions,npm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"A worm tore through npm by making the malware look perfectly legitimate"}]} ```