# 'ChainDrop' worm compromises hundreds of popular npm packages

DevFeed: ['ChainDrop' worm compromises hundreds of popular npm packages](<https://devfeed.tech/articles/chaindrop-worm-compromises-hundreds-of-popular-npm-packages-8296.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/>)

Author: Christophe Tafani-Dereeper, Nick Frichette, Sebastian Obregoso, Martin McCloskey

Published: 2026-08-04T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [backdoor](<https://devfeed.tech/topics/backdoor.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [backdoor](<https://devfeed.tech/tags/backdoor.md>), [chaindrop](<https://devfeed.tech/tags/chaindrop.md>), [github](<https://devfeed.tech/tags/github.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>)

## AI overview

ChainDrop is an npm worm that spread a backdoor through hundreds of compromised packages. The article analyzes its loader, which downloads or invokes Bun to run a second-stage payload.

## Source excerpt

On August 4, 2026, several popular npm packages, including 'keyv', were compromised to deliver malware.