On 4 August 2026, a self-propagating worm called ChainDrop (a Shai-Hulud variant) entered the npm ecosystem. Via a compromised GitHub maintainer account for the keyv ecosystem, the project’s own GitHub Actions pipeline built and published poisoned versions of keyv, cacheable, flat-cache, file-entry-cache and more — 444 packages, ~2 billion downloads a month. A malicious preinstall hook harvests npm, GitHub, cloud, Kubernetes and Vault credentials, then self-propagates; its C2 lives in an Ethereum smart contract, defeating domain blocklists.
Why this matters for Cyprus dev teams
Any Cyprus company shipping software with Node.js is exposed: you never chose to install ChainDrop — it arrives as a transitive dependency in a routine npm install, most dangerously on a CI runner with broad access to secrets, cloud and registries. One poisoned build leaks every CI token, and any resulting customer-data loss is a GDPR / NIS2 reportable breach.
What to do now
- Audit npm publishing and GitHub activity for unexpected releases, new tokens and Actions changes.
- Rotate credentials, npm, GitHub, cloud, SSH and automation — as potentially exposed.
- Disable install scripts (
npm config set ignore-scripts true), pin versions and lockfiles, verify provenance. - Isolate CI: ephemeral runners, least privilege, scoped secrets, egress filtering.
How we help
We surface build-and-deploy exposure for Cyprus teams with a secure code review, container security assessment and cloud configuration review, and map the blast radius of a leaked CI token with an assumed-breach assessment. Get a fixed-price quote.
Sources: Unit 42, Zscaler ThreatLabz, Elastic Security Labs, StepSecurity analyses; CSA Singapore advisory; CSO Online, The Register.