Worm Ships Malware With Valid Provenance; Supply-Chain Security Certifies It Flawlessly

There is a version of the software supply-chain security story where the system holds. Where the years of work — the provenance attestations, the SLSA framework, the OIDC “Trusted Publishing” that replaced long-lived tokens with short-lived cryptographic proof that a package came from the workflow it claims to have come from — all of it snaps into place and catches the thing it was built to catch.

That is not this version.

On August 4, 2026, a self-propagating npm worm called ChainDrop tore through the registry and poisoned hundreds of packages in under four hours. By the time anyone had a name for it, it had spread across 444 packages and more than 1,300 malicious versions, representing over two billion monthly installs. And it did all of this while shipping releases with valid SLSA provenance and clean attestations. The malware was not forged. It was not unsigned. It came through the front door, badge first, and the badge was real.

The worm did not fake its security credential. It earned one.

Here is the part worth slowing down for, because the precision is the whole joke.

The attackers compromised the GitHub account behind Keyv, a caching library that pulls roughly 150 million weekly downloads. From there they had access to the projects’ own release workflows — the legitimate, cryptographically blessed pipelines that turn a git tag into a signed npm package. So they did not smuggle anything past those pipelines. They fed the malware into them and let the pipelines do their job.

The workflow built the malware. The workflow signed the malware. npm’s Trusted Publishing looked at the malware, confirmed it came from exactly the workflow it was supposed to come from — which was true — and stamped it with valid provenance. Every automated provenance check downstream then looked at that stamp and saw a legitimate release, because by every definition the system was designed to enforce, it was a legitimate release. The attestation attested. The chain of trust chained. The system worked perfectly and certified a worm.

This is the security equivalent of a bank vault that verifies your identity, confirms you are indeed you, and then helps you carry out the contents on the grounds that a verified person is a trusted person. The lock was never broken. The lock had no opinion about what you did once it decided you were allowed in, and nobody had asked it to.

Related packages went down alongside Keyv — cacheable, flat-cache, file-entry-cache, cache-manager, cacheable-request — the quiet infrastructure nobody thinks about because it is supposed to be the boring part. The caching layer. The stuff that just works. It just worked.

The mechanism, once you are past the philosophy, is straightforwardly grim. Run npm install on an affected package and a hidden preinstall script — setup.mjs — fires before you have done anything at all. To dodge whatever scanning your normal Node toolchain might apply, it declines to use your normal Node toolchain. It downloads a fresh, temporary Bun runtime and executes a heavily obfuscated payload inside it, on the reasonable theory that your defenses were watching the door you know about.

Then there is the command-and-control, which is where ChainDrop stops being merely competent and becomes almost editorial. The payload does not hardcode a server that a blocklist could kill. It queries an Ethereum smart contract — address 0xE1f2395ee43e45A1556EC6438a88c31B83493103, if you would like to admire it — reaching out across as many as 75 public RPC endpoints. The contract returns an AES-256-GCM-encrypted list of domains. To rotate the entire attack infrastructure, defeat every domain blocklist in existence, and re-point the whole botnet, the attacker submits one blockchain transaction.

We were promised, for the better part of a decade, that decentralization would deliver censorship resistance and unstoppable infrastructure that no single authority could take down. And here, at last, it has delivered precisely that, exactly as advertised, on time and to spec — for the malware. The one deployment where the whitepaper’s promises all came true is the one you would have preferred to break.

Now the part that concerns us specifically, at a publication about AI.

ChainDrop is not just harvesting the usual credential haul, though it is doing that too — GitHub, npm, AWS, Kubernetes, Vault, Azure, Google Cloud, Terraform, Docker, Slack, the entire keyring of a modern engineering org. It also hunts, with clear intent, for the credentials of your AI coding assistant. Anthropic and Claude keys. OpenAI and Codex keys. Cursor. Gemini. The tokens that let a machine write code on your behalf are now a named target, sitting on the shopping list right next to your cloud root credentials, because in 2026 they are worth roughly the same thing.

It also tries to stay. The worm attempts persistence through Claude Code hooks and VS Code tasks — the same automation surfaces developers set up so their AI assistant can run helpful things automatically. The hook you configured so the robot could be useful without asking is a lovely place for a worm to live, because it, too, runs automatically and without asking. Then it exfiltrates what it finds and creates public GitHub “dead drops,” which is a wonderfully casual phrase for staging your stolen secrets in the open on the same platform where the whole thing started.

So: we built a cryptographic chain of trust to prove our packages are real. The worm used it to prove the worm was real. We gave our AI assistants standing permission to act on our machines. The worm applied for the same permission and was, structurally, granted it. Everywhere we automated away a human checkpoint in the name of velocity and trust, ChainDrop found a checkpoint with nobody standing at it, and walked through nodding politely.

The system did not fail. That is the uncomfortable finding. Every component performed its function. The attestation was valid. The provenance was genuine. The signature verified. The permission was granted. It is only when you step back and look at the whole cryptographically-notarized, blockchain-resilient, AI-credential-harvesting thing at once that you notice we automated everything except the part where someone asks whether this is a good idea.

That part is still yours. It appears to be the only part left.

Sources: