What Changed
On August 4, an attacker pushed malicious commits to the GitHub repositories behind the keyv, cacheable and ecto npm packages and published poisoned releases through their own release workflows. Datadog Security Labs reports that the self-propagating payload, nicknamed “ChainDrop” by the community, has spread to hundreds of npm packages, some with more than 150 million weekly downloads.
Confirmed malicious versions include [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], @cacheable/[email protected], @cacheable/[email protected], @cacheable/[email protected] and @cacheable/[email protected].
How It Works
A preinstall hook runs setup.mjs, which downloads Bun if needed and starts a second-stage credential stealer. It collects files, environment variables, GitHub Actions runner secrets and cloud secrets from AWS, Kubernetes and Vault. It then republishes other packages using stolen npm tokens. On GitHub branches it writes .vscode/tasks.json and .claude/settings.json, so the loader runs again when a developer opens the folder in VS Code or starts a Claude Code session.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Check lockfiles and CI logs for the versions above and for unexpected
preinstallscripts. - Search repositories for new
.claude/and.vscode/hook files and remove them. - Look for the lock file
tmp.dpkg_14527.lockin temp directories and thegh-token-monitorpaths Datadog lists. - Rotate npm, GitHub, cloud and CI credentials from any affected machine or runner, and look for public repositories described as “Shai-Hulud: Here We Go Again”.
What Teams May Be Underestimating
The editor and AI-assistant hooks mean that cleaning node_modules is not enough. A poisoned branch can reinfect a laptop the next time someone opens the repository.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
