npm 12 blocks install scripts and the ChainDrop worm hits 444 packages

npm 12 stops dependency install scripts by default, ChainDrop spread through a release with valid provenance, and an AI model published to PyPI. What to do.

npmPyPISupply ChainSecurityCI/CD

Between July 8 and August 6, 2026, three events changed how JavaScript and Python developers should think about dependencies. npm 12 became latest on July 8 and stopped running dependency install scripts by default. On August 4, the ChainDrop worm spread through 444 npm packages, starting from a release with valid provenance, and on July 30 Anthropic disclosed that one of its models had published a malicious package to the real PyPI during a security evaluation. React Native and Expo projects commonly depend on install scripts, so all three affect day-to-day mobile work.

What changed in npm 12

On July 8, 2026, npm v12 became the latest release. Dependency preinstall, install and postinstall scripts and implicit node-gyp builds "no longer run unless explicitly allowed". The --allow-git and --allow-remote options now default to none.

The migration path is an allowlist. You run npm approve-scripts --allow-scripts-pending and commit the resulting allowlist in package.json.

Publishing is tightening too. Granular tokens that bypass 2FA lost sensitive account actions in early August 2026 and lose direct publishing around January 2027. GitHub recommends trusted publishing (OIDC) or staged publishing instead.

What happened with ChainDrop

On August 4, 2026, an attacker took over the GitHub account of the keyv/cacheable maintainer and pushed poisoned commits. Those commits triggered the projects' legitimate release workflows, and keyv@6.0.0 was published at 09:35 UTC through OIDC trusted publishing, with valid provenance.

According to StepSecurity, the worm then reached "444 packages and 2,212 versions" between 09:40 and 13:20 UTC. A preinstall dropper downloaded Bun v1.3.13, and the command-and-control domain was resolved through an Ethereum contract.

The payload stole npm, GitHub and cloud credentials, plus AI-tool credentials (.claude, .cursor, .openai). It also planted re-infection hooks in .claude/settings.json (SessionStart) and .vscode/tasks.json.

Singapore's CSA issued advisory AD-2026-009 on August 6. It counts over 1,300 affected package versions and about 2 billion monthly downloads, and it advises rotating credentials and rebuilding affected systems. The two version counts differ, so treat both as estimates of the scale.

What happened on PyPI

On July 30, 2026, Anthropic disclosed three incidents in its cyber evaluations. In one, Claude Mythos 5 published a malicious package to the real PyPI. It was available for "roughly one hour" and was "downloaded and run on 15 real systems".

Anthropic traced the root cause to a misconfiguration with its evaluation partner, Irregular, that left machines online. It stopped all cyber evaluations on July 23 and notified the affected organizations on July 27.

What it means for your app

npm 12 will break some installs. React Native and Expo projects often depend on postinstall steps for native builds, patch-package and Husky. Until you approve those scripts, expect missing patches, missing Git hooks or failed native steps.

Valid provenance did not stop ChainDrop. The first malicious release came from the real repository, through the real release workflow, with valid provenance. Provenance records how a package was built, and in this case the build itself started from hostile commits. The defenses that still help sit on your side: pinned versions, lockfiles with a minimum release age, and narrowly scoped CI tokens.

If you maintain packages, the token change sets a deadline. Granular tokens that bypass 2FA already lost sensitive account actions in early August, and they lose direct publishing around January 2027. A CI pipeline that publishes with such a token today needs a new path before then.

The worm's preinstall dropper is exactly the kind of step that npm 12 no longer runs for dependencies by default. Under npm 12's rules, a project that had not allowed an affected package's scripts would not have run that dropper on install. That is the strongest argument for upgrading and for keeping the allowlist short.

AI coding agents are now involved on both sides. ChainDrop went after their credentials and config files, and the PyPI incident shows that a model with network access can publish a real package. Treat .claude/ and .vscode/ config as part of your security perimeter.

Checklist

Upgrade to npm 12 on a branch, run npm approve-scripts --allow-scripts-pending, and approve only the scripts you can give a reason for.
Commit the allowlist in package.json and review every change to it like code.
Run a clean install and a full iOS and Android native build to find packages that depended on postinstall.
Move your own package publishing to trusted publishing (OIDC) or staged publishing before 2FA-bypass tokens lose direct publishing around January 2027.
Pin versions, commit lockfiles, and set a minimum release age so that brand-new versions do not reach CI on the day they are published.
Scope CI tokens to one repository and to the smallest set of permissions each job needs.
If any machine installed an affected package on August 4, rotate npm, GitHub, cloud and AI-tool credentials, and rebuild the system as the CSA advisory recommends.
Audit .claude/settings.json and .vscode/tasks.json for hooks or tasks you did not add, and require code review for changes to them.

My take

npm 12's default is correct, and the cost lands hardest on mobile projects. React Native and Expo apps need a deliberate allowlist, and there will be pressure to approve everything just to get the build green. Resist it, because each approved script runs on every developer machine and CI runner.

ChainDrop is the more uncomfortable lesson. GitHub recommends trusted publishing, and ChainDrop's first malicious release went out through exactly that path, with valid provenance. You should still use it. Pair it with strong protection on maintainer accounts and careful review of anything that can trigger a release workflow.

Anthropic disclosed the PyPI incident and traced it to an evaluation setup error. It is still a clear reminder that an agent with network access and credentials can publish real packages. Give your agents the same least-privilege treatment you give CI.