Reported by 3 outlets

Timeline

1. update from bleepingcomputer.com

   ChainDrop: Self-Replicating npm Worm Compromises 1,300+ Packages — keyv Maintainer Account Taken Over, 2B Monthly Downloads Affected

   bleepingcomputer.com · 70d ago · August 5th, 2026

   The largest npm supply-chain attack of the year is still unfolding. Early Tuesday an attacker compromised the GitHub account of the maintainer of keyv (600M+ monthly downloads) and unleashed ChainDrop, a self-propagating worm built on TeamPCP's open-source Mini Shai-Hulud framework. Within four hours it had injected malicious code into 440+ packages; Aikido now counts 868+ packages across 1,381 versions, and BleepingComputer puts the total past 1,300 packages with a combined 2 billion monthly downloads — including keyv, cacheable, flat-cache, and file-entry-cache, plus packages tied to Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. Wiz reports the root packages sit in ~46% of cloud environments (vs ~28% for the Shai-Hulud 2.0 campaign's most prevalent packages).

   • Delivery: malicious files pushed directly to main branches, then released through the projects' legitimate GitHub Actions workflows — so the poisoned npm versions carried valid provenance information.

   • Payload: a preinstall hook (node setup.mjs) downloads the Bun runtime from GitHub to execute an obfuscated infostealer (Math_Symbol.js / math_init.js). It validates every token against registry.npmjs[.]org/-/whoami before theft, then harvests GitHub PATs and workflow tokens, npm tokens, GitHub Actions secrets, AWS/SSM/Secrets Manager, Kubernetes secrets, HashiCorp Vault, database credentials, Stripe/Slack/Twilio/Azure/GCP keys, AI config files, and crypto wallets.

   • Exfil: encrypted data is pushed to a public GitHub repository whose description reads "Shai-Hulud: Here We Go Again"; Wiz flags the domain npm-cache[.]com as a strong IOC.

   • Status: Microsoft, Aikido, Socket, and Wiz agree the same payload/pattern across all packages points to one attacker/cluster using multiple stolen tokens; Wiz has not observed new malicious packages since the initial four-hour wave, but says hard attribution to TeamPCP (Google previously tied the operator to a South Africa-based individual) is not yet established.

   Hunting hypothesis: npm install events touching known-bad versions, setup.mjs/Math_Symbol.js file creation, unexpected Bun runtime downloads, and outbound connections to npm-cache[.]com from build hosts.

   Action: Any workstation or CI runner that installed an affected version is compromised — rebuild from known-good backups, rotate every token/secret the environment could reach (including cloud provider keys and Vault), and review repos for unexpected commits. Full package and IOC lists are published by Wiz, StepSecurity, Aikido, Socket, and Ox Security; dependency allowlisting and provenance checks are the control that breaks this class.

2. update from unit42.paloaltonetworks.com

   ChainDrop npm Worm Rotates C2 via Ethereum Contract, Mints Real Provenance for Poisoned Packages

   unit42.paloaltonetworks.com · 68d ago · August 7th, 2026

   Unit 42's deep-dive on the ChainDrop/Shai-Hulud worm adds major new detail: C2 domains are resolved from an Ethereum smart contract (0xE1f2395ee43e45A1556EC6438a88c31B83493103) and were silently rotated to awqhnjewqjkl.icu on August 4, with a GitHub commit-search fallback, and the worm scrapes GitHub Actions runner memory for OIDC tokens and ephemeral secrets. A repository-gated path targeting opensearch-js signs poisoned tarballs with genuine Sigstore/SLSA provenance — valid provenance no longer means a clean package — and 453 public exfiltration repositories were found across five accounts. With 400+ packages (keyv, flat-cache, cacheable-request, cache-manager) still compromised, enumerate every package your npm credentials can publish, rotate exposed credentials, and clear poisoned lockfiles and caches, which survive tag rollbacks.

3. update from malware.news

   Tracking Shai-Hulud: Inside the ChainDrop NPM Worm

   malware.news · 63d ago · August 11th, 2026

   IntroductionOn August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a single blockchain transaction and rendering domain-based blocklists ineffective.The attacker compromised the GitHub account of the maintainer of the keyv ecosystem, injecting malicious code into the source repository. Because the build originated from the legitimate repository and workflow, at least some of the resulting packages (most notably keyv6.0.0) were published to npm bearing authentic Supply Chain Levels for Software Artifacts (SLSA) provenance attestations, making them indistinguishable from clean releases to automated security tooling. Aikido Security researchers found that the worm propagated to more than 400 packages. ChainDrop spread by stealing developer tokens and republishing infected versions of every package those tokens could reach. Key Characteristics of ChainDropChainDrop weaponizes trusted build infrastructure. A signed origin does n