Another npm worm [LWN.net]

StepSecurity is reporting the emergence of a new worm affecting npm packages. The design of the worm is nothing new, but the rapidity with which it is exploiting captured npm packager credentials is noteworthy.

TL;DR: A self-propagating worm, which we are calling ChainDrop, is spreading rapidly through the npm ecosystem. So far 435 packages and more than 1,550 compromised versions have been flagged, starting with keyv@6.0.0. If you are using any of the packages listed below, assume your environment is compromised. We are still investigating the full scope; check back on this post for updates.

to post comments

And AI coding agents often want extensions from npm...

Posted Aug 5, 2026 17:14 UTC (Wed) by ejr (subscriber, #51652) [Link] (1 responses)

What possibly could go wrong? And being someone who would expect to see something named Math_Symbol.js appear because of my specialties, well...

Found a Math_Symbol.js in a llama.cpp ui build on 1 July under regenerate-unicode-properties. It looks pre-worm (three non-obfuscated lines that just add ranges to a set), but I am annoyed that I had to look.

And AI coding agents often want extensions from npm...

Posted Aug 5, 2026 17:22 UTC (Wed) by ejr (subscriber, #51652) [Link]

BTW, if running over a large set of directories, the equivalent fd / fd-find / fdfind commands appear to be the following:

fdfind -HI -t f -p '.*\/node_modules\/.*(Math_Symbol\.js|math_init\.js)$' ~

fdfind -HI -t f -p 'node_modules/.*/setup.mjs' ~ -x sh -c "grep -q oven-sh/bun {} && echo SUSPICIOUS: {}"

These only popped up the one (false) positive for me, and they're partially LLM-generated translations, but they might save you a bit of typing. Nothing is wrong with find. These simply seem faster if going though TBs of directories.