ChainDrop and the Shai-Hulud Lineage: Anatomy of a Self-Propagating npm Supply Chain Worm

Executive Summary

Between late 2025 and mid-2026, the software supply chain threat landscape underwent a fundamental paradigm shift with the emergence of the Shai-Hulud malware lineage. Culminating in the highly sophisticated ChainDrop variant discovered on August 4, 2026, this self-propagating worm targeted the Node Package Manager ecosystem by compromising foundational open-source libraries. Unlike conventional typosquatting or dependency confusion attacks, the Shai-Hulud lineage operates as a true recursive worm, weaponizing the credentials of compromised developers and Continuous Integration and Continuous Deployment environments to autonomously inject itself into subsequent software packages, creating an accelerating blast radius that impacted over 444 unique packages and exposed an estimated two billion monthly transitive downloads.

The ChainDrop campaign specifically compromised the GitHub account of a prominent maintainer responsible for the keyv caching ecosystem, which is deeply embedded in the transitive dependency trees of ubiquitous tools such as ESLint. The attack execution demonstrated an unprecedented understanding of modern software release pipelines. By operating entirely within the compromised maintainer's GitHub account and driving legitimate release automation, the attackers abused OpenID Connect Trusted Publishing. Consequently, malicious package versions were published with mathematically valid Supply Chain Levels for Software Artifacts provenance, effectively bypassing modern security gates designed to verify artifact authenticity.

Technically, the payload represents a significant escalation in supply chain attack sophistication. Upon installation, a preinstall hook executes an obfuscated dropper that downloads a standalone Bun runtime, evading Node.js-specific monitoring and guaranteeing execution across operating systems. The subsequent memory-resident payload conducts aggressive credential harvesting across more than 200 paths, introduces novel persistence mechanisms by hooking AI-assisted developer tooling such as Claude Code and Visual Studio Code, and scrapes GitHub Actions runner process memory for ephemeral OIDC tokens. Exfiltration and command-and-control operations are orchestrated via EtherHiding, utilizing an Ethereum smart contract to dynamically resolve routing endpoints, rendering traditional domain-based takedowns ineffective.

The strategic implications of the Shai-Hulud campaigns highlight critical vulnerabilities in the decentralized trust models of open-source software. The incident has catalyzed systemic regulatory and platform-level responses, including the Singapore Cyber Security Agency issuing formal advisories, and GitHub fundamentally altering the npm ecosystem by releasing npm v12 to disable lifecycle scripts by default. The widespread credential exposure demands that organizations pivot from simple dependency remediation to comprehensive incident response, treating any affected host as a compromised entity requiring total credential rotation and infrastructure rebuilding.

Verification of Claims

1. Claim: The ChainDrop worm infected the keyv package family and spread to over 444 packages, impacting roughly two billion monthly downloads. → Verified → Multiple independent security vendors confirmed the compromise of the target maintainer GitHub account on August 4, 2026, leading to the poisoning of keyv, cacheable, flat-cache, and file-entry-cache.

2. Claim: The malware utilizes Ethereum smart contracts for dynamic C2 resolution (EtherHiding). → Verified → Decompilation of the payload confirms the malware queries the Ethereum mainnet contract using specific function selectors to retrieve active exfiltration domains.

3. Claim: The malicious releases carried perfectly valid SLSA provenance. → Verified → Forensic analysis confirms the attacker committed malicious code directly to the GitHub repository and triggered the legitimate release workflow, resulting in cryptographically valid SLSA provenance via OIDC Trusted Publishing.

4. Claim: The malware persists by hooking AI-assisted coding tools like Claude Code and VS Code. → Verified → The payload writes malicious execution hooks to configuration and tasks files, ensuring the credential stealer re-executes whenever a developer opens the project in these environments.

5. Claim: The malware incorporates a "nuclear option" or failsafe to wipe the host machine's home directory. → Partially verified → This destructive capability was prominently documented during the November 2025 variant, but technical analyses of the August 2026 ChainDrop variant note credential harvesting and AI hooks as primary behaviors, with the wiper function unconfirmed in this specific iteration.

Timeline

Attack Anatomy

Initial Access Unlike traditional supply chain attacks relying on stolen npm publishing tokens, ChainDrop achieved initial access by compromising the GitHub account of a foundational maintainer. The threat actor operated entirely within GitHub, making direct pushes and generating releases on keyv and related caching packages. Because these projects utilized OIDC Trusted Publishing, native release workflows automatically triggered and published poisoned packages to npm with valid SLSA provenance.

Execution When a consumer runs npm install on a poisoned package, a preinstall lifecycle hook executes an obfuscated setup script before application code loads. The script determines host architecture and downloads a standalone Bun JavaScript runtime binary directly from GitHub. It then executes the second-stage payload using Bun and deletes the binary to remove forensic artifacts, utilizing multi-layered Base91 encoding and AES-256-GCM encryption.

Persistence The ChainDrop variant introduces persistence mechanisms by writing execution hooks directly into local AI-assisted development configuration files. The payload commits tasks and settings files for Visual Studio Code and Claude Code, ensuring the credential stealer re-executes whenever a developer opens the project or initiates an AI coding session.

Collection The malware executes a platform-aware filesystem scan across roughly 200 hardcoded credential paths, targeting npm tokens, GitHub tokens, AWS and cloud infrastructure credentials, Kubernetes service accounts, HashiCorp Vault tokens, and API keys for AI tools and financial services. On Linux GitHub Actions runners, it reads process memory directly to extract ephemeral OIDC tokens.

Exfiltration To guarantee exfiltration resilience, the malware utilizes EtherHiding, querying an Ethereum mainnet smart contract via public RPC nodes to dynamically resolve active exfiltration routing endpoints. Secondary exfiltration channels utilize stolen GitHub tokens to create public repositories committing encrypted credential bundles.

Threat Actor Profile

• Name / Alias: TeamPCP (PCPcat, ShellForce, DeadCatx3)

• Attribution Confidence: Medium — Based on significant code overlap with the Shai-Hulud offensive framework and established targeting patterns.

• Motivation: Espionage and Financial — Mass credential harvesting targeting CI/CD secrets, cloud environments, Vault, and cryptocurrency wallets.

• Sophistication Level: Advanced — Demonstrated by OIDC Trusted Publishing exploitation, JavaScript obfuscation with Base91 and AES-256-GCM, memory scraping, and Ethereum smart contract C2.

• Known Previous Operations: Shai-Hulud V1 (September 2025), Shai-Hulud 2.0 (November 2025), AntV ecosystem compromise (May 2026), Miasma campaign.

• Nation-State Nexus: Suspected — Scale of intelligence gathering targeting foundational cloud infrastructure and AI tooling.

• MITRE ATT&CK Techniques:

• T1195.002 — Supply Chain Compromise: Software Dependencies

• T1059.007 — Command and Scripting Interpreter: JavaScript

• T1552.001 — Credentials in Files

• T1552.004 — Private Keys

• T1552.007 — Cloud Instance Metadata API

• T1056.003 — Input Capture: Web Portal Capture

• T1567.001 — Exfiltration Over Web Service

• T1568.002 — Dynamic Resolution: Blockchain C2

• T1036.005 — Masquerading: Match Legitimate Name

• Operational Security (OpSec): Exfiltration channels utilize RSA encryption prior to transmission; EtherHiding ensures decentralized and resilient C2 infrastructure.

Technical Indicators

domains:
  - "npm-cache[.]com"
  - "awqhnjewqjkl[.]icu"
  - "pypi-get[.]com"
  - "js-mirror[.]com"
  - "eth-mainnet.nodereal[.]io"
  - "eth.llamarpc[.]com"
  - "go.getblock[.]io"
ip_addresses: []
file_hashes:
  - type: "sha256"
    value: "9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc"
    description: "Math_Symbol.js / math_init.js heavily obfuscated second-stage payload"
  - type: "sha1"
    value: "e65b155ce74f3f81fb7d2b5b60f8e62b36e6d69c"
    description: "Math_Symbol.js / math_init.js secondary hash"
  - type: "sha256"
    value: "54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668"
    description: "setup.mjs dropper file"
  - type: "sha1"
    value: "35a672cf34b996b91f3e1c28cbf3a05a37e036e4"
    description: "setup.mjs secondary hash"
  - type: "sha256"
    value: "fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb"
    description: "setup.mjs variant hash"
urls:
  - "hxxps://npm-cache[.]com/router"
c2_infrastructure:
  - "Ethereum Smart Contract Address: 0xE1f2395ee43e45A1556EC6438a88c31B83493103"
  - "Ethereum eth_call selector: 0x53ed5143"
  - "GitHub Repository Marker: 'Shai-Hulud: Here We Go Again'"
  - "GitHub Bot Impersonation: 'github-advanced-security[bot]'"
  - "GitHub Bot Impersonation: 'claude@users.noreply.github.com'"
  - "Malicious Branch Marker: 'dependabot/github_actions/format/setup-formatter'"
 

Legal and Regulatory Response

Law Enforcement Actions

Further details are not yet publicly available.

Government Directives

The Cyber Security Agency of Singapore issued formal public advisory AD-2026-009 detailing the ongoing npm supply chain attack affecting keyv and related packages. The agency mandated that affected systems be treated as entirely compromised, requiring total rebuilding of environments and comprehensive rotation of all cloud credentials and tokens rather than standard malware removal.

Platform Response

GitHub officially released npm version 12, which sets allowScripts to off by default, universally blocking preinstall and postinstall lifecycle scripts from automatic execution. GitHub also initiated the deprecation of write-scoped Granular Access Tokens bypassing 2FA and introduced the Staged Publishing framework requiring human approval steps.

Criminal Proceedings

Further details are not yet publicly available.

Impact Assessment

• [Packages Poisoned]: Confirmed: Over 444 unique packages and 2,212 malicious versions were poisoned in the August 4, 2026 wave.
• [Monthly Downloads Affected]: Estimated: Approximately two billion combined monthly downloads were transitively exposed to the malware.
• [Ecosystem Saturation]: Confirmed: Compromise of the keyv package family accounted for vast caching ecosystem poisoning, extending to cacheable, cache-manager, ecto, flat-cache, and file-entry-cache.
• [Transitive Blast Radius]: Reported: Widespread dissemination was facilitated by semver inversion via file-entry-cache acting as a core dependency of ESLint.
• [Victim Organizations]: Reported: More than a dozen major organizations directly impacted, including Zapier, ENS Domains, PostHog, AsyncAPI, and Red Hat Cloud Services.
• [Malicious GitHub Repositories Created]: Confirmed: Over 800 public GitHub repositories generated by malware using stolen credentials as dead-drop exfiltration sites.

Lessons and Defensive Recommendations

For Security Teams / SOC Analysts: Actively hunt for post-install artifacts such as setup.mjs, math_init.js, or dynamically dropped Bun runtime binaries inside node_modules or temporary directories. Implement robust network monitoring to detect unexpected queries to Ethereum RPC nodes and unauthorized API requests to cloud Instance Metadata Services. Audit organizational repositories for unauthorized branch creations and fake commit authors mimicking AI bots.

For Developers and Architects: Treat affected hosts as critically compromised rather than attempting surgical malware removal; completely rebuild developer workstations and CI runners from clean base images. Verify that IDE configuration files have not been tainted with environment setup hooks before reopening repositories. Establish a mandatory soak period for open-source libraries before adoption.

For Platform / Cloud Providers: Upgrade internal development toolchains and CI environments to utilize npm v12 or higher with allowScripts configuration strictly enforced. Ensure CI/CD runners are ephemeral and heavily hardened, segmenting memory spaces to prevent OIDC token scraping, and destroying runners after every execution.

For Leadership / CISO: Mandate a strict operational sequence for incident response: halt all publishing and CI builds, wipe and rebuild infrastructure, and only then execute comprehensive rotation of all cloud, GitHub, and npm credentials. Transition open-source publishing away from classic tokens to Staged Publishing and OIDC Trusted Publishing.

Sources

1. Cyber Hub. "Cybersecurity Incidents and Developments from Mid-August 2026". August 2026.

2. StepSecurity Research. "ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with". August 2026.

3. Cuon. "Legitimate provenance did not stop the malware". August 2026.

4. JFrog Security Research. "Major Shai Hulud campaign strikes npm again, affecting keyv and". August 2026.

5. Mend.io Threat Labs. "Malicious keyv Package on npm Steals CI Secrets via GitHub". August 2026.

6. Checkmarx Zero. "Shai-Hulud Worm Strikes a 6th Time - keyv/cacheable npm Supply". August 2026.

7. Aikido. "Keyv and friends compromised in npm supply chain attack". August 2026.

8. Zscaler ThreatLabz. "ChainDrop NPM Worm Analysis". August 2026.

9. Elastic Security Labs. "Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages". August 2026.

10. Cyber Security Agency of Singapore (CSA). "Ongoing npm Supply Chain Attack Affecting Keyv and Related". August 2026.

11. Socket.dev. "npm v12 Ships With Install Scripts Off by Default". August 2026.

12. CyberChief AI. "NPM Breach August 2026 - Shai-Hulud: Here We Go Again". August 2026.

13. GitHub Marketplace. "Shai-Hulud 2.0 Detector". November 2025.

14. Hive Pro. "Shai-Hulud npm Supply Chain Worm Compromises keyv Ecosystem". August 2026.

15. Snyk. "SHA1-Hulud, npm Supply Chain Incident". November 2025.

16. Checkmarx Zero. "Shai-Hulud's Second Coming: NPM Malware Attack Evolved". November 2025.

17. Datadog Security Labs. "Worm compromises hundreds of popular npm packages". August 2026.

18. Mend.io. "Shai-Hulud-Style Malware Hits Red Hat npm Packages". August 2026.

19. Phoenix Security. "npm sha1 hulud supply chain compromise explained". September 2025.

20. Endor Labs. "Popular lightning PyPI Package Backdoored in Latest Shai-Hulud". August 2026.

21. Expel. "Mini Shai Hulud: Cross-ecosystem supply chain worm targeting npm". August 2026.

22. PrivatePackets. "The Shai-Hulud worm: A new era of supply chain attacks". August 2026.

23. Cycode. "Shai-Hulud NPM Supply Chain Attack". August 2026.

24. SOCRadar. "ChainDrop: Self-Propagating npm Supply Chain Worm Targeti". August 2026.

25. Hive Pro. "Mini Shai-Hulud npm Supply Chain Worm: TanStack and Multi". August 2026.

26. Datadog Security Labs. "Shai-Hulud Goes Open Source". August 2026.

27. Stéphane Robert. "Shai-Hulud is back: an npm worm loots the AntV ecosystem". May 2026.

28. Vibe Coding Security. "keyv / cacheable npm worm ('ChainDrop') — Shai-Hulud-lineage". August 2026.

29. Kimoun. "Shai-Hulud: 868 briques logicielles piégées le 4 août 2026". August 2026.

30. AskAnything. "The Keyv/Cacheable npm Worm: A Confirmed Mini Shai-Hulud Descendant". August 2026.

31. InfoQ. "npm Staged Publishing Available, Adding a Human Approval Step". August 2026.

32. Hollo. "JavaScript". August 2026.

33. Phoenix Security. "Mini Shai-Hulud npm Worm Hits keyv and cacheable". August 2026.

34. Cycode. "keyv & cacheable npm Worm Weaponized AI Agents". August 2026.