ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheable

Attackers compromised a GitHub maintainer account controlling keyv, cacheable, flat-cache, and file-entry-cache Node.js packages that collectively receive over a billion downloads monthly. Malicious code was pushed directly to the main branch and automatically published to npm with valid signatures. A hidden preinstall script downloads a Bun runtime to execute an obfuscated payload that harvests npm, GitHub, AWS, Kubernetes, and Vault credentials, scans for SSH keys and environment files, and exfiltrates data to attacker-controlled GitHub repositories and Ethereum smart contracts. The worm then uses stolen npm tokens to infect additional packages autonomously. This self-propagating attack, tracked as ChainDrop, belongs to the Shai Hulud family responsible for previous campaigns targeting TanStack, Mistral AI, and OpenSearch packages in May 2026.

• Inside a Self-Propagating npm WormMalware2026-08-07
• The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesMalware2026-11-02
• Shutting the Door on the XCPE BotnetMalware2026-11-02
• Black October for AI Developer PlatformsCampaign2026-10-31
• Google Brotli · Node2Shell / HTTP2Shell Vulnerability May Allow RCEExploitedVulnerability2026-10-28