What happened, in plain English
Modern websites and apps are assembled from thousands of small, free code packages, mostly downloaded from a service called npm. In early August 2026, attackers took over the accounts of people who maintain some popular packages and published poisoned updates.
When a developer's computer or an automated build system installed one of those updates, hidden code ran immediately. It searched for passwords and access keys (for hosting, cloud services like AWS, GitHub and npm itself) and sent them to the attackers. Then it used any stolen npm access to poison more packages, which is why it spread so fast. Singapore's Cyber Security Agency counts more than 1,300 affected package versions, with a combined 2 billion downloads a month.
Are you affected?
Worth checking if
- Your site or app is custom-built with JavaScript tools: React, Next.js, Vue, Node.js, React Native and similar
- Your developer, agency or automated build system installed or updated code packages since August 2026
- Your developer has access to your hosting, cloud, domain, GitHub or app store accounts
Probably not affected if
- Your site is standard WordPress with no custom JavaScript build process
- Your site is on Shopify, Squarespace, Wix or Webflow with no custom code
- Nobody has built or updated your site's code since July 2026
Your website visitors aren't the target here. The danger is that stolen keys let attackers into the accounts behind your site, where they could change it, take it down or reach customer data later.
Questions to ask your developer
- "Did any of our projects install an affected package version?" They can check the project's lock files and build caches against the published list.
- "Did any computer or build server that touched our project install one?" If so, the security agencies say to treat that machine as compromised.
- "Have you rotated our keys and passwords since?" That means hosting, cloud, GitHub, npm, domain and app store credentials, changed from a clean machine.
- "Have you checked our accounts for activity we don't recognize?" For example, new users, new code repositories, unexpected releases or changed settings.
What to do
- Remove affected versions from your projects and build systems, and lock them to known-good versions.
- Rebuild any machine that installed a poisoned package, and clear package caches on build servers.
- Change every exposed password and key from a clean computer. Start with the ones that control your hosting, code and cloud accounts.
- Review account activity on GitHub, your cloud provider and npm for anything unexpected since early August.
- Slow down updates going forward. Waiting a few days before installing brand-new package versions gives the community time to catch poisoned ones. Recent npm versions can enforce this automatically.
What we do for clients
For custom-built projects on an Evergreen monthly plan, this is part of routine maintenance: we check your project and build systems against the published lists, rotate any exposed credentials and set up a waiting period for new package versions. If you work with a different developer and want a second opinion, we can review the project as a one-off job and tell you plainly where you stand.
Sources
- Cyber Security Agency of Singapore: Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages (August 6, 2026, updated November 2, 2026)
- Microsoft Security: ChainDrop supply chain compromise (August 4, 2026)
This page is general information based on the public sources listed above, as of the review date. It isn't a security assessment of your site or app, and it can't tell you for certain whether you're affected. Details can change quickly, so check the official sources for the latest.