Jared Wray, founder and CEO of Hyphen AI and maintainer of the Keyv and Cacheable npm packages, has published a postmortem confirming that a stale full-access GitHub personal access token was the entry point for the ChainDrop supply chain worm. The August 31 disclosure is the first account from inside the compromise that tore through npm on August 4, 2026.
There is no CVE attached to ChainDrop, because nothing in the code was vulnerable — a maintainer's credentials were. StepSecurity, which named the worm, recorded 444 poisoned packages across 2,212 versions in under four hours, starting with [email protected], a package pulled more than 150 million times a week.
How Did the ChainDrop Worm Get Into Keyv?
Wray held two GitHub tokens: a read-only one created within the past year, and a second, more than two years old, with full access. He believed the older token had been replaced. It had not, and it sat on a machine that was later infected alongside his repositories and .env files. Passkeys, 2FA and a move to OIDC releases were already in place and did not reduce that token's authority. "Leaving that credential active was my failure. I am sorry," Wray wrote.
Why Valid Provenance Did Not Stop It
The attacker pushed poisoned commits to jaredwray/keyv, cacheable and ecto, then let the projects' own release workflows do the publishing. [email protected] went out at 09:35 UTC through GitHub Actions and npm OIDC trusted publishing, carrying a genuine SLSA attestation.
As StepSecurity put it, "Provenance proves which commit was built. It cannot prove the commit was authorized." A preinstall hook then downloaded the legitimate Bun runtime to execute a 727,680-byte second stage that harvested npm, GitHub, AWS, Kubernetes and Vault credentials.
Which New Control Breaks Which Step
Wray's remediation maps onto specific hops in the kill chain rather than adding generic hardening:
| Kill-chain step | Control is now in place |
|---|---|
Stolen PAT pushes to main |
Write-capable PATs removed; 90-day access reviews |
| Workflow publishes attacker's tag | Staged publishing — CI can stage, but only a human promotes with 2FA |
| The victim installs the new version | pnpm minimumReleaseAge: 10080 (7 days) |
preinstall hook fires |
strictDepBuilds; lifecycle scripts require explicit approval |
The seven-day cooldown alone would have outlasted every malicious release, all of which were under two hours old when installed.
What Should Developers Check Now?
Grep every lockfile for the eleven first-wave versions, then look for setup.mjs or Math_Symbol.js inside node_modules. Reinstall with --ignore-scripts. One warning before rotating: the worm plants a token monitor at ~/.local/bin/gh-token-monitor.sh that fires a payload when the stolen GitHub token is revoked. Remove it first.
GitHub and npm halted propagation within roughly seven hours; Wray reports the code was gone from every branch within 36 hours.