Skip to main content
August 5, 2026 • 7 min read • By The Public Code US Team

400 Packages Poisoned in a Day: The npm Worm Wave

On August 4, the keyv worm hit 400+ npm packages with valid cryptographic signatures. Three weeks earlier, @asyncapi fell the same way. The year's supply-chain attacks keep proving the same point: signatures verify identity, not intent — and the commons needs public investment, not just attestations.

A worm eating through a stack of package boxes with the words 400 packages poisoned and trusted signatures did not stop it

400 Packages Poisoned in a Day: The npm Worm Wave

On August 4, 2026, attackers compromised the GitHub account of maintainer Jared Wray and pushed malicious code into keyv — a caching library most developers have never heard of and nearly all of them transitively depend on. Because the poison went in upstream of the build, Wray’s own legitimate CI built it, signed it, and published 11 malicious releases carrying valid GitHub-Actions-signed npm provenance.

Microsoft designated it “ChainDrop.” By disclosure, it had spread to 400+ packages representing roughly 2 billion combined monthly downloads.

Let that sink in: the cryptographic signatures worked exactly as designed. They verified who published the code. They said nothing about what the code did. The worm wore a valid badge all the way down.

Anatomy of ChainDrop

The details, from the Snyk, Kodem, and Chainguard writeups, are worth understanding because they show what the next decade of supply-chain attacks looks like:

  • Entry: a compromised maintainer account — not a code vulnerability, a human one.
  • Execution: a preinstall hook (setup.mjs) plus a Bun runtime and a 727KB obfuscated payload, harvesting npm, GitHub, AWS, Vault, Kubernetes, and CI credentials.
  • The tell: it also harvested AI-tool configs — Claude, OpenAI, Cursor, Gemini credentials. The attackers know where the industry’s crown jewels moved.
  • Command and control: an Ethereum smart contract (StringListStore → npm-cache.com). Take down the domain and the blockchain still answers.
  • Propagation: stolen publish tokens turned every compromised package into a new launchpad. Worms don’t need you to click anything.

Three weeks earlier, on July 14, the @asyncapi packages fell to a different flavor of the same disease: a misconfigured GitHub Actions pull_request_target workflow let attackers steal a bot token through 37 decoy pull requests, then publish 5 malicious versions across 4 packages. The payload executed at import/require time — defeating the --ignore-scripts defense everyone recommends — fetched its second stage from IPFS, and shipped with valid OIDC provenance. Everything was unpublished within about four hours. It still got out.

It Was Already a Wave

ChainDrop and @asyncapi weren’t isolated. They were the summer crest of a year-long pattern:

  • March 31 — axios. A North Korea-nexus group (UNC1069) used AI-deepfake video calls to socially engineer a maintainer: cloned a founder’s identity, built a fake Slack workspace, ran a Teams call where a fake error prompt tricked him into running an “update” that deployed the WAVESHAPER.V2 backdoor. Malicious axios releases were live for 169 minutes. Axios gets ~100 million downloads a week.
  • May 11 — TanStack. Eighty-four malicious versions across 42 packages via a poisoned GitHub Actions pnpm cache, with OIDC tokens extracted from runner memory. Valid SLSA Build Level 3 provenance. The poison spread downstream to UiPath, Mistral AI, and OpenSearch packages.
  • June 1 — @redhat-cloud-services. Thirty-two packages, 96 malicious versions — “Miasma,” a derivative with Greek-mythology theming and a preinstall hook.

Every one of these attacks succeeded with the security machinery working: valid signatures, signed provenance, trusted identities. The machinery verifies the envelope. The letter inside was poison.

What Actually Helps

The standard industry response — more attestations, more signatures, more SBOMs — is necessary and insufficient. Note the timing: in January 2026, OMB rescinded the Biden-era memos requiring standardized secure-development self-attestations from federal software vendors. The uniform attestation regime is gone; agencies now set their own “risk-based” policies.

Here’s the problem with “risk-based” as a substitute: you cannot risk-assess what you cannot see. Attestations are vendor self-reports. Signatures verify publishers. Neither tells you whether the code is safe. The only mechanism that scales against this class of attack is the one this campaign exists for:

  1. Public, auditable code and builds. Reproducible builds let anyone verify that the published artifact matches the public source. Sunlight doesn’t prevent every attack, but it collapses the dwell time — compare @asyncapi’s four hours to the months that closed-source compromises routinely enjoy.

  2. Funded maintainers. Every one of these attacks entered through an under-resourced chokepoint: a single maintainer’s account, a misconfigured workflow nobody had time to audit, a project running on volunteer nights and weekends. Attackers have budgets. Defenders have burnout. Public money should fix that asymmetry — Germany’s Sovereign Tech Agency (tens of millions across 100+ projects) is the working model.

  3. Procurement that demands it. The federal government is the world’s largest software buyer. When it buys closed, unauditable dependencies, it subsidizes the attack surface. When it requires open code, reproducible builds, and funded maintenance, it shrinks it.

The worms aren’t a reason to fear open source. They’re the reason to fund it — because the alternative isn’t safety, it’s the same attacks succeeding in the dark.

  1. Sign the petition. Public money should fund auditable code, not black boxes with valid signatures.

  2. Contact your representatives. Ask what replaced the rescinded attestation memos. If the answer is “risk-based,” ask what they can see.

  3. Get organized in your state. States run their benefits, courts, and elections on this same supply chain.

  4. Share this post. 400 packages. Valid signatures. Two billion downloads. The badge doesn’t mean what people think it means.

Read more: Washington Ordered Its AI Open. The Inventory Says Almost Nobody Listened. · The Code That Decides Your Life Runs on Trade Secrets · The Maintainers Are Quitting. Who Keeps the Lights On?

Sources

Share This Post

Ready to Take Action?

Sign the Petition