Singapore's Cyber Security Agency (CSA) published advisory AD-2026-009 on August 6, 2026, and it was still being updated on September 7 — a month later and still moving, which by itself tells you the incident isn't over. The scale: over 1,300 package versions on the npm registry compromised, representing roughly 2 billion combined monthly downloads.

The Poisoned Packages Are Caching Primitives Almost Nobody Installs Directly

Named versions include keyv 6.0.0, cacheable 2.5.1, cacheable-request 13.0.20, flat-cache 6.1.24 and file-entry-cache 11.1.6. Note what they have in common: hardly anyone installs these on purpose. They sit deep in the dependency trees of ESLint, HTTP clients and build tooling. "I've never installed those" is therefore not a valid check — you have to actually look at the tree.

What It Steals: SSH Private Keys Are on the List

The malware is ChainDrop, a self-propagating variant of the Shai-Hulud family. What it exfiltrates: cloud credentials, GitHub tokens, SSH keys, Kubernetes configurations and Terraform credentials, sent to the domain npm-cache[.]com — a name deliberately chosen to look like npm's own infrastructure. With those in hand it uses stolen publisher credentials to poison more packages, which is precisely how it reached 1,300+ versions.

Microsoft Threat Intelligence's August 4, 2026 analysis adds the execution detail: 400+ packages across multiple unrelated publishers, a heavily obfuscated Bun-based JavaScript payload, executed through npm's preinstall lifecycle hook — before installation even finishes. The hook files named in the CSA advisory are setup.mjs, Math_Symbol.js and math_init.js.

The initial foothold wasn't an exotic zero-day: a phishing email dressed up as an npm security alert took over a maintainer's account.

Why Server Administrators Have to Treat This as Their Problem

The crux is that a preinstall hook runs as your user. Whatever you can read, it can read. And on a box that both serves production and gets the occasional npm install, the same home directory typically holds:

  • ~/.ssh/id_ed25519 — quite possibly a key that logs into other servers without a password
  • cloud CLI credential caches, plus database passwords and API keys in .env
  • ~/.docker/config.json, ~/.kube/config, ~/.terraform.d/

Put differently: on a developer laptop a supply-chain attack steals code access; on a server it steals the keys to the whole estate.

Four Things to Do Now

  • Inspect the tree: npm ls keyv cacheable cacheable-request flat-cache file-entry-cache. You can also read the pinned versions straight out of the lockfile with grep -n "keyv\|flat-cache\|file-entry-cache" package-lock.json.
  • If you match, treat the host as compromised. CSA's guidance is blunt: remove affected versions, treat systems as compromised, rebuild machines where malicious packages were installed, rotate all exposed credentials, and review cloud and source-control environments for unauthorised access. Rotation means SSH keys, GitHub tokens and cloud API keys — not just a password change.
  • Check historical egress for npm-cache[.]com. That gives you direct evidence of whether the payload actually ran.
  • Change the habit: install with --ignore-scripts in CI and production (npm ci --ignore-scripts), handling the few packages that genuinely need build scripts separately; run builds and services as different low-privilege users; put a passphrase on SSH keys; turn off agent forwarding; and keep keys that can push to production off production machines.

Separating Build From Runtime Is Itself a Control

The worst outcomes in incidents like this land on the "one machine does everything" setup — build host, production host and key store all in one. Move builds onto a separate instance that holds no production credentials and no passwordless path into production, and a poisoned package costs you a machine you can rebuild at will. Deploying a Node.js app on a VPS with PM2 covers process and user separation, and VPS backup strategies covers what has to be true before "rebuild it" is a real option. SharkCloud instances bill by the hour and can be recreated on demand — a dedicated build box costs far less than one credential leak.