Dev & AI weekly — August 22, 2026

Two weeks ago we covered a hijacked npm maintainer account and said to check your lockfile. That incident turned out to be patient zero. This week the full scope landed: a self-propagating worm across 400+ packages with two billion monthly installs, using the Ethereum blockchain for command-and-control. Meanwhile an open-weight model took the top spot on a cybersecurity benchmark, and the CDN a large chunk of the web sits behind had a rough eight days. Here's what matters if you build.

ChainDrop: the keyv hijack was patient zero

On August 8 we wrote up the compromise of keyv and the cacheable family. That was the first two hours of something much larger. The campaign now has a name — ChainDrop — and the numbers are ugly: 435 packages, 1,557 poisoned versions, republished in a two-hour burst, with a combined two billion monthly installs. Casualties include flat-cache (~565M monthly), file-entry-cache (~557M), and cacheable (~29M), plus packages under the servicetitan, ornikar, qlik, and nebula.js namespaces.

The mechanics are worth understanding because they're a step up. Every infected version carries a preinstall dropper that downloads the legitimate Bun runtime — a trusted, signed binary — and uses it to execute roughly 710 KB of obfuscated second-stage malware. That stage harvests npm, GitHub, AWS, and cloud credentials, then uses the stolen npm tokens to republish more packages. That's the worm loop: install → steal → republish → repeat.

The genuinely novel part is command-and-control. ChainDrop, a descendant of the Shai-Hulud 2.0 lineage, uses the Ethereum blockchain for C&C — a technique called EtherHiding. There's no domain to sinkhole and no server to seize; the instructions live in an immutable public ledger that your network egress filter almost certainly permits.

Why it matters: two lessons, both concrete. First, ignore-scripts is no longer optional hygiene — npm config set ignore-scripts true would have neutered the entire delivery mechanism, and npm v12 makes it the default for a reason. Second, and more uncomfortable: using a legitimate runtime as the execution vehicle defeats naive binary allowlisting. Downloading Bun looks fine. If your build pipeline touched any of these packages in August, rotate npm, GitHub, and cloud tokens now rather than auditing first — and audit after. Also worth internalizing: your transitive dependency graph is your attack surface, and flat-cache at half a billion installs a month is not a package anyone chose deliberately.

GLM-5.3 takes the top cyber benchmark — and the weights are coming

Z.ai released GLM-5.3 on August 14 (with a GLM-5.2 Turbo variant following on the 17th), and the headline result is pointed: 84.5% on CyberGym, edging past Anthropic's Mythos 5 at 83.8% to lead the cybersecurity benchmark. It also posts a claimed ~50% jump on its internal Code Bench, with gains across Terminal-Bench 3.0, DeepSWE 1.1, and AutomationBench.

The interesting engineering detail: GLM-5.3 reuses the GLM-5.2 base exactly — no new architecture, no re-pretraining, no larger parameter count. Every gain comes from post-training on a 743B base. The weights aren't public yet; Z.ai is targeting around August 28 on Hugging Face, after further safety testing.

Why it matters: last week OpenAI gated GPT-5.6-Cyber behind vetted access precisely because a model tuned for offensive-security work is dual-use. This week an open-weight lab posted a better score on the same class of benchmark and announced plans to publish the weights in two weeks. Whatever you think of the policy debate, the practical consequence is direct: the ChainDrop-style attacker and the person auditing their dependencies are about to be running comparable tooling. The other takeaway is cheaper and more useful day-to-day — a 50% capability jump from post-training alone, on an unchanged base, is more evidence that most teams are leaving enormous gains on the table in how they fine-tune and prompt rather than in which base model they rent.

Cloudflare's rough week: 13 outages in 8 days

If your app felt flaky recently, it might not have been you. Cloudflare logged 13 incidents in 8 days, with R2 and Durable Objects taking the brunt. On August 20–21 alone: elevated errors for R2 and Durable Objects, downstream service errors, mTLS validation issues, missing R2 audit logs, and network performance degradation in India, Indonesia, Mumbai, and Vienna.

Why it matters: none of these were a full-internet outage, and that's exactly the problem — partial, regional, service-specific degradation is far harder to detect and design around than a clean outage. If you're on R2 or Durable Objects, this is the nudge to check that your code actually handles a storage call that's slow-but-not-failing, and that your alerting distinguishes "our bug" from "our provider's bad hour." The broader point we keep landing on: a single provider for storage, DNS, CDN, and edge compute is a great developer experience and a single correlated failure domain. You don't need to abandon it — you need to know which of your critical paths have no fallback, and decide deliberately whether that's acceptable.

ChatGPT Ads lands in 31 European markets

On August 19, OpenAI announced its largest geographic ads expansion to date: ChatGPT Ads goes live in 31 European countries starting August 24 — Germany, France, Spain, Italy, the Netherlands, the Nordics, and more. Ads appear for Free and Go accounts; paid and organizational plans stay ad-free. At launch they're explicitly not personalized — selection uses the current conversation topic, approximate location, device type, time of day, and language, which is a fairly transparent accommodation of GDPR's consent requirements for targeted advertising.

Why it matters: the discovery layer you're optimizing for is changing shape. If a meaningful share of your users' "how do I do X" questions now resolve inside an assistant that also serves ads against the topic of the conversation, then "ranking" increasingly means being the thing the model cites, not the tenth blue link. Nobody has a reliable playbook for that yet, and anyone selling you one is guessing. But the direction is clear enough to watch closely — and it's a reminder that "we get traffic from search" is a strategy with an expiry date nobody has published.

The through-line

Attackers automated their way to 435 compromised packages in two hours using a public blockchain as infrastructure. An open lab beat the frontier labs on a cyber benchmark and will ship the weights. The CDN under a large slice of the web wobbled for a week. And the front door to information is quietly becoming an ad-supported chat product. The pattern: capability keeps decentralizing — to attackers, to open models, away from any single gatekeeper — while the infrastructure and distribution we all quietly depend on stays concentrated. That asymmetry is where the risk lives.

What to watch next: whether GLM-5.3's weights actually land around August 28 — and how many ChainDrop-stolen credentials show up in a second wave now that the worm has had three weeks to harvest them.

Sources: Infosecurity — ChainDrop worm hits 400 npm packages · Elastic Security Labs — Shai-Hulud strikes again: CHAINDROP · SecurityWeek — Over 400 npm packages infected · Semgrep — ChainDrop hits 400+ packages · Developer Tech — GLM-5.3 tops CyberGym · Kingy AI — GLM-5.3 specs & benchmarks · Cloudflare Status — incident history · Shattered.io — Cloudflare logs 13 outages in 8 days · OpenAI — ChatGPT Ads expands across Europe · Search Engine Land — ChatGPT Ads expanding to 31 European countries