CHAINDROP
A self-propagating npm worm went live at 09:35 UTC on 4 August 2026 with
keyv@6.0.0 — 153.7M weekly downloads — and kept publishing itself with credentials
it stole from each victim. This page is an independent monitor: it reads the npm registry changes feed,
inspects every newly published version that carries an install hook, downloads the tarballs of packages
that are still installable, and hashes the payload inside them.
Live feed
Newest compromised versions first. own detection means this scanner found it in the npm changes feed itself; vendor means it arrived from a published IOC list and was then re-checked here.
Publish rate
Malicious versions published per 10-minute bucket, from the registry's own publish timestamps.
Every affected version
Status is re-checked against the registry continuously. Installable means the exact version still resolves on npm right now.
| Package | Version | Status | Weekly downloads | Published (UTC) | Evidence |
|---|
Am I affected?
Paste a package-lock.json, yarn.lock, pnpm-lock.yaml or the output
of npm ls --all. Matching happens in your browser; nothing is uploaded.
Indicators of compromise
Collected from Socket, Wiz, StepSecurity, Snyk and Aikido, and confirmed here against live tarballs.
If you installed one of these
- Treat the machine or CI runner as compromised. The payload runs at
preinstall, before any of your code. - Rotate everything that was reachable from it: npm tokens, cloud keys, GitHub tokens, SSH keys, CI secrets, Vault and Kubernetes credentials.
- Remove the token watcher before revoking the stolen GitHub token — the worm fires a payload when it sees the token die.
- Check for IDE persistence:
.claude/settings.json,.claude/math_init.js,.vscode/tasks.json. - Pin to a known-good version and rebuild from a clean cache. Provenance attestations do not help here: the malicious releases were signed by the projects' own GitHub Actions workflows.