ghtier
← Back to Organization plane incidents
OrganizationAugust 2026

ChainDrop: a hijacked maintainer account publishes through trusted publishing

On 4 August 2026 an attacker used the GitHub account of the maintainer of keyv and cacheable, packages with well over 100 million weekly npm downloads together. The commits went straight to main, unsigned, which StepSecurity reads as a stolen token or session used through the API; how the account was taken is not known. The attacker then cut releases, and the projects' own release workflows published the malware through npm trusted publishing, with valid provenance. No npm token was stolen for this part. The payload, a descendant of Shai-Hulud 2.0, steals npm and GitHub tokens, cloud keys and SSH keys from developer machines and CI runners, publishes itself to every package the victim can publish, and in victims' repositories adds a workflow that dumps the secrets context, then deletes the branch. It also writes .vscode/tasks.json and .claude/settings.json into repositories to run again later. StepSecurity counted 2,212 versions of 444 packages within about four hours. Provenance showed which commit was built, not whether anyone should have pushed it.

Permissions abused

contents:write (push to main, create release tags)workflows:write (secrets-dumping workflow in victims' repositories)The project's own trusted publishing workflow

On the permission reference

T1Workflows: WriteT2Contents: Write

Sources

Reported by: StepSecurity

How it unfolded

  1. 1

    The maintainer's GitHub account is used

    Unsigned commits appear on main of keyv, cacheable and related repositories under the maintainer's name. How the attacker got the account or token is not established.

  2. 2

    A release runs the real publish workflow

    The attacker creates releases, and each project's release workflow publishes to npm through trusted publishing. The packages carry valid provenance because the workflow really did build them.

  3. 3

    Installs steal credentials

    A preinstall script downloads the Bun runtime and runs the payload, which collects npm and GitHub tokens, cloud credentials and SSH keys from the machine or runner.

  4. 4

    The worm spreads and digs in

    With the stolen tokens it publishes infected versions of the victim's own packages, adds a workflow that writes the secrets context to an artifact and then removes the branch, and plants editor and agent config files that run it again.

Mitigations

  • Require a pull request on the default branch, with no bypass for maintainers — every malicious commit went straight to main

  • Restrict who can create release tags with a ruleset — a release was all it took to start the publish workflow

  • Put the publish job behind an environment with required reviewers — trusted publishing ran for whoever triggered it

  • Require signed commits — the attacker's commits were unsigned

  • Use security keys or passkeys for maintainer accounts — the maintainer's account was the single point of failure

Frameworks

CICD-SEC-1CICD-SEC-2CICD-SEC-9CICD-SEC-3CICD-SEC-6NIST 5.1.2NIST 5.1.3NIST 5.1.4

Part of

Contained. First seen August 2026. How the attacker got in is not confirmed. 2,212 malicious versions of 444 npm packages in about four hours; other trackers count slightly more (as of 4 August 2026, source). Mapping by ghtier, not yet reviewed. Threat landscape