npm supply-chain malware attacks

In late July 2026, two beta versions of npm packages under the @joyfill namespace were found to contain a remote‑access trojan. The malicious code activates on import, retrieves encrypted payloads from multiple blockchains, and can download additional code from a remote server. Security analysts linked the activity to the PolinRider threat cluster, which they suspect is part of a broader North‑Korean operation that previously ran the ViteVenom campaign.

A few days later, a far larger supply‑chain campaign emerged. Attackers compromised the GitHub account of a maintainer of the popular Keyv caching library and injected pre‑install scripts into Keyv and several related packages. The resulting ChainDrop worm downloads the Bun runtime and runs a credential‑stealer that harvests tokens and secrets from cloud services, container platforms, and development tools. The worm self‑propagates, affecting over 800 packages and receiving billions of downloads, and can change its command‑and‑control infrastructure via an Ethereum smart contract. The campaign has impacted organizations such as Deliveroo, Qlik, ServiceTitan, and Picsart and is described as a descendant of the earlier Shai‑Hulud worm.

Together, these incidents illustrate a rapid escalation in npm‑based supply‑chain attacks, moving from targeted trojan delivery to a widespread, self‑propagating worm that harvests a broad range of credentials across the software ecosystem.