Ghostdrive

News · Academy · November 12, 2026

Academy: supply chain hygiene for teams that ship software

ChainDrop and TanStack hit hundreds of npm packages in 2026, some with valid provenance. Controls that help: cool-down, pinning, scoped tokens.

DRIVE 369 DAO · 2 min read

Academy, organisations, lesson 12. Your software is mostly other people's software. In 2026 attackers went after the people who publish it.

What happened this year

  • ChainDrop (August 4). A worm spread through more than 400 npm packages via stolen maintainer and publishing tokens. Some releases went through a legitimate build workflow, so they carried valid provenance (Microsoft).
  • TanStack (May). Reports say more than 160 npm and PyPI packages were compromised, with 84 malicious versions across 42 packages carrying valid SLSA provenance (secondary reporting).
  • The lesson in both: provenance tells you which workflow built a package. It does not tell you that the build was honest.

Controls that help

  1. Wait a few days before adopting a new release. npm added a min-release-age setting in version 11.10.0 (February 2026), pnpm has minimumReleaseAge and Yarn has npmMinimalAgeGate (reported by Socket). They differ in units and defaults, and most are off by default, so turn them on. Microsoft recommends the same for ChainDrop.
  2. Pin and review. Lock exact versions, use npm ci in builds, and review dependency changes in pull requests.
  3. Narrow publishing tokens. One publish token should reach one package, with two-factor authentication for publishing and short lives where the registry allows.
  4. Protect the build. Require approval before a workflow can publish, restrict what a pull request from a fork can run, and watch for releases that have no matching commit or tag.
  5. Keep secrets out of laptops and runners. A worm reads what is lying around (lesson).
  6. Know what you ship. A software bill of materials lists the components in a build. CISA and its partners published new minimum elements for it in 2026 (reported by ExecutiveGov).
  7. Treat AI-tool configuration as code. ChainDrop wrote Claude and editor configuration files into repositories to infect the next developer. Review changes to them like any other.
  8. Vet agent tools. MCP servers and agent skills are dependencies too. Approve them from a list.
  9. If a bad version ran: rotate every credential on that machine from a clean one, pin a known-good version, purge package caches and rebuild from a clean base.

How Ghostdrive approaches it

We use npm, so we are in the same world. Our guards are narrow: the private AI model's files are checked against their pinned hashes every time they load, the desktop app sends its node token only to a listener that proved it knows it, and installers are not trusted just because they are on a page we control.

Academy: start here · ChainDrop briefing · Ten guardrails for agents