A campaign was identified on August 4, 2026, targeting the maintainer of Keyv, a popular JavaScript key-value storage library This article explores typical malware chaindrop. . This incident is noteworthy given that Keyv has garnered over 600 million downloads in recent months.
The affected packages include flat-cache with nearly 580 million downloads, cacheable-request with more than 137 million, cacheable with over 30 million, and cache-manager with over 16 million monthly downloads. Unlike typical malware, CHAINDROP not only infects new installations but also trojanizes every package modified by the compromised maintainer and published through npm. This latest infection begins with a preinstall hook added to a package’s package.json file, which executes commands before installation completes.
Researchers noted that this naming distinction helps differentiate compromised packages directly through the Keyv monorepo from those infected later by the worm. If Bun isn't present, it determines the host operating system and processor type, downloads version 1.3.13 of Bun, extracts it, and uses it to run the malicious JavaScript. Researchers discovered Dune-themed strings, such as "mentat," "lasgun," "sietch," and "sandworm," indicating ties to earlier Shai-Hulud activity.
