Jared Wray, founder and CEO of Hyphen AI and maintainer of the Keyv and Cacheable npm packages, has published a postmortem confirming that a stale full-access GitHub personal access token was the entry point for the ChainDrop supply chain worm. The August 31 disclosure is the first account from inside the compromise that tore through npm on August 4, 2026. There is no CVE attached to ChainDrop, because nothing in the code was vulnerable — a maintainer's credentials were. StepSecurity , which named the worm, recorded 444 poisoned packages across 2,212 versions in under four hours, starting with keyv@6.0.0 , a package pulled more than 150 million times a week. How Did the ChainDrop Worm Get Into Keyv? Wray held two GitHub tokens: a read-only one created within the past year, and a second, more than two years old, with full access. He believed the older token had been replaced. It had not, and it sat on a machine that was later infected alongside his repositories and .env files. Passkeys,…
