In this guide · 8 sections
- 01What CSA's npm supply-chain advisory says
- 02Is my business affected if I don't write code?
- 03Questions to ask your web developer or agency
- 04What CSA recommends developers do
- 05If an affected package was installed
- 06Put supply-chain security into your vendor contract
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
CSA advisory AD-2026-009 (6 August 2026) reports a self-spreading malware that compromised over 1,300 npm package versions. If your site or app uses JavaScript tooling, ask your developer whether affected versions were installed, and whether keys and passwords on their machines were rotated.
What CSA's npm supply-chain advisory says
Modern websites and apps are built from hundreds of small, free code libraries called packages. For JavaScript, most come from the npm registry. A supply-chain attack is when an attacker poisons one of those packages, so everyone who installs the update gets the malicious code.
CSA's advisory AD-2026-009, dated 6 August 2026, describes 'ChainDrop', a variant of the Shai-Hulud malware family. According to CSA it compromised over 1,300 package versions with a combined 2 billion monthly downloads, including caching libraries such as keyv, cacheable, flat-cache and file-entry-cache. The malware steals developer credentials and uses them to infect more packages.
| Advisory | Date | What it covers |
|---|---|---|
| AD-2026-003 | 7 April 2026 | General guidance on securing the software supply chain; cites the March 2026 compromise of the Axios npm package |
| AD-2026-009 | 6 August 2026 | Active Shai-Hulud / ChainDrop attack on keyv and related npm packages, with affected versions and indicators |
Is my business affected if I don't write code?
Possibly. You are exposed if anyone who builds or runs software for you installed an affected package version on their laptop, build server or your hosting. The risk is not only to the website itself. CSA says the malware steals credentials such as cloud keys, GitHub tokens and SSH keys, which are often the keys to your hosting, domain and code repository.
- Likely in scope: websites and apps built with JavaScript tools (for example React, Next.js or Vue), custom Shopify apps, Node.js back-ends, and anything your developer deploys through an automated pipeline.
- Less likely, but ask: a standard WordPress or Shopify theme site. The platform itself is not built on npm, but developers often use npm tools to build custom themes and plugins.
- Not directly: a site built only in a hosted builder (such as Wix or Squarespace) with no custom code. The builder's own supply chain is the vendor's job.
Questions to ask your web developer or agency
You do not need to understand the code to ask good questions. Send these by email so you have a written answer.
Send this list to your developer
A good developer will answer in a day and will not be offended. A vague answer, or 'we don't use npm' when your site is built on React, is a reason to get a second opinion.
What CSA recommends developers do
CSA's advisory on securing the software supply chain (AD-2026-003) sets out the controls. In plain English:
Keep an inventory of components
CSA calls this a software bill of materials (SBOM): a list of the packages, services and APIs each project uses.
Pin versions with a lockfile
Use package-lock.json or yarn.lock so dependencies only change after review. The npm ci command installs exactly what the lockfile says and stops if it does not match.
Use fewer packages and audit them
Remove unnecessary dependencies and audit regularly for vulnerabilities and suspicious changes.
Give least privilege
Developer accounts, build servers and automated jobs should only have the access they need. Restrict production secrets.
Protect secrets
Never store credentials, private keys or tokens in code repositories. Use a secrets manager and alert on accidental exposure.
Watch the build pipeline
Alert on unusual dependency updates, install scripts and network connections from build machines.
Tools such as npm audit check against known vulnerability reports, so they help once a bad version has been reported. They are not a guarantee against a brand-new malicious release, which is why the lockfile and review steps matter.
If an affected package was installed
CSA's response steps from AD-2026-003 and AD-2026-009 are, in short: remove the affected versions, treat the machines as compromised and rebuild them, rotate every exposed credential, check cloud and code accounts for unauthorised access, and look for the published indicators of compromise.
For you as the owner, two extra checks matter. First, make sure the rotation covered your accounts too: hosting control panel, domain registrar, payment gateway API keys and any admin logins the developer used. Second, if customer personal data could have been accessed, assess it under the PDPA. CSA's advisory itself notes that a supply-chain breach can lead to non-compliance with the PDPA. Our PDPA breach notification guide explains the 3-day rule, and our website hacked guide covers clean-up if the live site was changed.
Put supply-chain security into your vendor contract
CSA suggests that organisations using paid vendors add four requirements to contracts: timely security patching, incident reporting, defined service levels for security events, and a right to audit the vendor's compliance. For a small business this can be a short clause, not a legal essay.
The same applies when developers use AI coding assistants, which can suggest new packages quickly. Our AI coding assistants comparison includes a short policy for contractors using AI on your code. If your site is WordPress, our guide to fixing a WordPress update that broke your site covers safe update habits.
Do it yourself or get help?
If you have a developer on retainer, send the checklist above today and keep the reply. If you do not, or the person who built your site has moved on, you may not know who still holds keys to your hosting and code.
Our Website Security Hardening (S$290) reviews access to your hosting, domain and repository, rotates keys and tightens settings. Care Plus (S$349 a month) keeps the site updated, monitored and backed up, with dependency updates reviewed rather than installed blindly.
Frequently asked questions
It is self-spreading malware placed in malicious versions of npm packages such as keyv and cacheable. CSA's advisory AD-2026-009 of 6 August 2026 says the ChainDrop variant compromised over 1,300 package versions. When installed, it steals developer credentials and uses them to publish infected versions of more packages.
WordPress itself runs on PHP, not npm, so a standard WordPress site is less directly exposed. However, developers often use npm tools when building custom themes and plugins, and the malware steals credentials from developer machines. Ask your developer whether any affected package versions were installed on machines that hold your site's keys.
A lockfile, such as package-lock.json or yarn.lock, records the exact version of every package a project uses. With it, installs repeat the same versions instead of silently pulling the newest release, which may be malicious. CSA recommends lockfiles so that versions only change after review through a change management process.
If an affected package was installed on a machine that held keys to your systems, yes. CSA advises treating exposed environments as compromised and rotating API keys, access tokens, SSH keys and other secrets immediately. Include your hosting panel, domain registrar, code repository and payment gateway keys in that rotation.
CSA suggests contracts with paid software vendors include timely security patching, incident reporting, defined service levels for handling security events, and a right to audit the vendor's compliance. Also agree who owns and holds the logins to your hosting, domain and code repository, so you are not locked out later.