Threats Tagged 'github compromise'

Multiple npm packages in the keyv/cacheable ecosystem were compromised after attackers gained control of a GitHub maintainer account. Beginning at 9:00 UTC on August 4, 2026, the attacker introduced IDE persistence mechanisms and published malicious versions that propagated to over 400 distinct packages. The payload is a descendant of the 'Mini' Shai-Hulud malware family, sharing similarities with TeamPCP and antv campaigns. It targets sensitive data including cloud credentials, infrastructure secrets, developer credentials, AI configuration files, and cryptocurrency wallets. The malware uniquely retrieves command-and-control domains from an Ethereum smart contract rather than embedding them, allowing infrastructure updates without modifying the payload. Data is exfiltrated through GitHub repositories created under compromised identities. The campaign demonstrates sophisticated supply chain attack techniques targeting developer environments and CI/CD pipelines.

The ChainDrop malware campaign involves attackers compromising a GitHub maintainer account for popular Node.js packages keyv, cacheable, flat-cache, and file-entry-cache. Malicious code was pushed to the main branch and automatically published to npm with valid signatures. The payload downloads a Bun runtime to execute obfuscated code that harvests credentials from npm, GitHub, AWS, Kubernetes, and Vault, scans for SSH keys and environment files, and exfiltrates data to attacker-controlled GitHub repositories and Ethereum smart contracts. The malware autonomously uses stolen npm tokens to infect additional packages, making it a self-propagating npm worm. ChainDrop is part of the Shai Hulud family of supply chain attacks previously observed in May 2026.