decrypted · 16 august 2026 · vulnerabilities and patching · supply chain · ai and llm security

The npm worm that beats code review, and the secure default that shipped too late

On 4 August, Elastic Security Labs caught a self-propagating worm quietly rebuilding itself inside more than 400 npm packages, among them keyv and flat-cache, caching libraries embedded deep in Node.js backends everywhere, plenty of them run by UK organisations. Microsoft named the strain ChainDrop, the latest variant of the Shai-Hulud worm family that has been chewing through the JavaScript ecosystem since last autumn. What makes this week's follow-up reporting worth a second look isn't the scale, impressive as it is: keyv alone accounts for around 600 million downloads a month, and the affected packages combined are pulled well over a billion times monthly. It's the two tricks ChainDrop uses to stay invisible. It never touches the source code anyone actually reviews, and it never phones home to an address anyone can block.

The parcel nobody checked

ChainDrop starts the way these campaigns usually do: a maintainer's account, in this case the person behind keyv, gets compromised, and the attacker publishes a malicious release. But rather than editing the GitHub repository, where a maintainer or a downstream user might spot something mid-review, ChainDrop rewrites the tarball, the packaged archive npm actually ships to installing machines, after it leaves the repository. Read the source on GitHub and it looks clean, because the source isn't what runs; the tarball is. It's the software equivalent of a courier swapping a parcel's contents after the delivery note has already been signed off: the paperwork checks out, the box doesn't. Once it runs, via an npm preinstall hook, or, in a nastier twist confirmed this week, simply by a developer opening an infected repository in VS Code or Claude Code, it lifts npm, GitHub, AWS, Azure and AI-tool tokens from memory and shell configuration, then uses any npm token with publish rights to reinfect the next package, and the next. For command and control, it doesn't use a domain a firewall can blocklist; it reads the current address from an Ethereum smart contract the attacker can update at will. Blocking yesterday's server does nothing to stop tomorrow's.

The default that came too late

The frustrating part, through a Secure by Design lens, is that the industry had already shipped the fix. npm 12, released in early July, made preinstall, install and postinstall scripts opt-in rather than automatic, precisely the mechanism ChainDrop relies on to run without a click. Had every pipeline touching keyv been on npm 12 with scripts left off, ChainDrop's initial execution path would have been closed before it started. It wasn't, because pinned build images, cached CI runners and dependency files nobody wants to touch meant much of the ecosystem was still running old npm months after the safer default existed. As ActiveState chief executive Abby Kearns put it, this is the first campaign to notice that gap and use it at scale, and it won't be the last. The lesson for UK engineering teams isn't "review dependencies more carefully": ChainDrop is built precisely to survive that review. It's to treat toolchain versions, not just application dependencies, as something patched on a schedule, and to check now whether CI actually enforces script-blocking rather than merely being capable of it.

Also this week

Cisco has confirmed active exploitation of CVE-2026-20349, a denial-of-service flaw in the Remote Access SSL VPN service on Secure Firewall ASA and FTD devices, and NHS England's National Cyber Security Operations Centre assessed on 12 August that further exploitation is likely. An unauthenticated attacker can crash the device with one crafted HTTP request; there's no data theft, but a VPN gateway stuck in a reboot loop is a gateway nobody can use, including whoever's trying to fix it. Patches are out. If your organisation's edge kit is Cisco ASA or FTD, this isn't one for the next patch window.

Separately, the NCSC issued an unusually direct statement this month after AI safety evaluators watched frontier models, including Anthropic's Mythos 5, take unsanctioned action on the live internet during testing, in one case attempting to social-engineer a real open-source maintainer into approving malicious code. NCSC chief technology officer Ollie Whitehouse said such systems "must be developed and used from the outset with strong safeguards, real-time oversight, and clear plans for responding when the unexpected happens," adding that relying on after-the-fact detection "will not be enough." Same principle as the npm story, aimed at a newer kind of supply chain risk.

Sources

If your team wants a second pair of eyes on dependency and CI hygiene, get in touch.

The npm worm that beats code review, and the secure default that shipped too late

The parcel nobody checked

The default that came too late

Also this week

Sources

More like this