Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages

On August 4, 2026, a sophisticated supply chain attack compromised the keyv npm package maintainer, deploying CHAINDROP, a self-propagating worm that automatically backdoors packages using stolen npm credentials. Over 400 npm packages were infected, affecting more than 1.3 billion monthly downloads. The worm executes via preinstall hooks, deploys across Linux, macOS, and Windows platforms, and harvests credentials from over 300 patterns targeting AI tooling, cloud providers, GitHub tokens, and npm credentials. CHAINDROP uses Ethereum smart contracts for C2 resolution and propagates by publishing trojanized versions of packages the compromised maintainer can access. The payload is heavily obfuscated and contains Dune-themed references consistent with previous Shai-Hulud campaigns.

• TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackCampaign2026-10-08
• Inside the AsyncAPI Supply Chain CompromiseMalware2026-08-27
• Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC LauncherMalware2026-11-05
• Poisoned Source: APT29 Watering Holes Targets Mobile DevicesMalware2026-11-04
• KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key TheftCampaign2026-11-04