ChainDrop: The Mini Shai Hulud npm worm’s latest wave hits keyv and cacheable

ChainDrop is a self‑propagating npm supply‑chain worm (disclosed 2026-08-04) that compromised a maintainer’s GitHub for widely used Node.js utilities (keyv, cacheable, flat-cache, file-entry-cache), added a hidden preinstall script (setup.mjs) which pulls a Bun runtime and executes an obfuscated credential‑stealing payload (Math_Symbol.js) to harvest npm/GitHub/AWS/Kubernetes/Vault secrets and exfiltrate them; stolen npm tokens are then used to publish backdoored packages to downstream projects — organizations should audit lockfiles, rotate credentials, and review CI/CD and registry activity.