CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)
› npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Aug 4, 2026
- closed
- Aug 15, 2026
- CVEs
- none
- sources
- 4
## summary
In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.
severity: Critical supply-chain worm
## affected
- Compromised patch versions published ~Aug 4 2026 (see Wiz/JFrog package lists)
## fixed in
- Pin known-good versions; purge caches; npm CLI 12+ disables preinstall by default
## timeline[2]
keyv/cacheable malicious releases observed; worm begins propagating.
Microsoft, Elastic, JFrog publish analyses; 400+ packages listed.
## advisories[1]
## news & write-ups[3]
## notes & caveats
patchStatus partial because cleanup is per-environment (lockfiles/caches/credentials). Distinct from Oct tensorlake wave already in seed.
