{"investigation":{"slug":"chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026","entity_name":"ChainDrop / Mini Shai-Hulud npm Supply Chain Worm (August 2026)","trust_score":0,"severity_base":null,"score_modifier":-10,"confidence":0.93,"status":"published","content_type":"investigation","summary":"ChainDrop is a self-propagating npm supply-chain worm detected on August 4, 2026, classified as the largest wave of the Shai-Hulud (Mini Shai-Hulud) malware family. After the GitHub account of keyv and cacheable maintainer Jared Wray (jaredwray) was compromised, a two-stage credential harvester was injected into 11 core packages and then spread itself to more than 400 further npm packages and over 2,200 versions, representing roughly two billion combined monthly downloads. The payload steals cloud, CI/CD, AI-tool and cryptocurrency wallet credentials and resolves its command-and-control domain through an Ethereum smart contract (EtherHiding); several vendors attribute it to the TeamPCP group, although Palo Alto Networks Unit 42 says it cannot confirm that attribution.","sections":[{"content":"ChainDrop is the name security researchers gave to a self-propagating npm supply-chain worm first detected on August 4, 2026. It is classified as the latest and most impactful wave of the Shai-Hulud worm family, specifically the fourth-generation Mini Shai-Hulud variant; prior generations include the original Shai-Hulud worm (September 2025), SHA1-Hulud (November 2025), SANDWORM_MODE (March 2026) and Mini Shai-Hulud (April 2026 onward). The campaign name derives from the worm's use of the Ethereum blockchain for command-and-control (C2) infrastructure, a technique known as EtherHiding. The attack began with the compromise of the GitHub account of Jared Wray (jaredwray), maintainer of the keyv and cacheable package ecosystems; the injected two-stage payload then self-propagated to more than 400 additional npm packages representing approximately two billion combined monthly downloads. Researchers categorise ChainDrop as a credential-harvesting campaign primarily targeting software developers and CI/CD environments, with explicit targeting of crypto and Web3 developer tooling and cryptocurrency wallets stored on affected developer machines, alongside cloud, CI/CD and AI coding tool credentials.","heading":"Overview and Classification","sources":[{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions","name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ - Tenable","type":"research","credibility":2},{"url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/","name":"ChainDrop supply chain compromise: Anatomy of a self-propagating worm - Microsoft Security Blog","type":"research","credibility":1},{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","name":"ChainDrop: Inside a Self-Propagating npm Worm - Palo Alto Networks Unit 42","type":"research","credibility":2},{"url":"https://www.sygnia.co/threat-reports-and-advisories/shai-hulud-returns-software-supply-chain-attack-npm-keyv/","name":"Shai-Hulud Returns: When Software Trust Becomes the Attack Surface - Sygnia","type":"research","credibility":2}],"severity":"critical"},{"content":"Multiple security vendors, including Wiz, Chainguard, JFrog and Orca Security, attribute the campaign to the threat group TeamPCP, also tracked by Google's Threat Intelligence Group as UNC6780 and under aliases including DeadCatx3, PCPcat, ShellForce and CipherForce. TeamPCP is described as a financially motivated, cloud-native cybercrime group first observed in November 2025 conducting cryptomining and credential theft campaigns. A spokesperson using the handle T00001B described the group in a Forbes interview as 'a loose-knit group of teenagers and young adults', though researchers note hybrid motivations including credential theft, access brokering and selective destructive activity with geopolitical undertones.\n\nAttribution of ChainDrop specifically is not settled. Palo Alto Networks Unit 42 states that it cannot confirm whether ChainDrop was operated by TeamPCP itself or by a separate actor reusing the Shai-Hulud toolkit that TeamPCP publicly released in May 2026, and one input page reported that no Tier 1 source had confirmed attribution of ChainDrop to TeamPCP or to any nation-state actor. The Dune-themed strings in the payload (the exfiltration repository description 'Shai-Hulud: Here We Go Again' and the fallback marker thebeautifulmarchoftime) are consistent across Shai-Hulud family campaigns but do not by themselves narrow attribution.\n\nThe August 2026 keyv attack has been assessed as the seventh major operational phase of TeamPCP. Prior activity attributed to the group includes: the March 2026 compromise of Aqua Security's Trivy GitHub Action and Checkmarx KICS, deploying the SANDCLOCK credential stealer (a Google GTIG designation), in which 76 of 77 Trivy GitHub Action tags were force-pushed and a related CanisterWorm infected 66+ npm packages using ICP blockchain C2; the March 2026 LiteLLM PyPI trojanization affecting approximately 1,705 dependent packages; the May 2026 TanStack and AntV npm attacks; and the breach of the European Commission's AWS environment, which CERT-EU officially attributed to TeamPCP on April 2-3, 2026. No law enforcement action or indictment related to ChainDrop or the broader Shai-Hulud family had been publicly announced as of the input research.","heading":"Attribution and Threat Actor","sources":[{"url":"https://socradar.io/blog/dark-web-profile-teampcp/","name":"Dark Web Profile: TeamPCP - SOCRadar","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","credibility":2},{"url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign","name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign - Chainguard","type":"research","credibility":2},{"url":"https://teampcp.pluto.security/","name":"TeamPCP - The supply chain attack story so far - Pluto Security","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/","name":"Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure - Palo Alto Unit 42","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","name":"ChainDrop: Inside a Self-Propagating npm Worm - Palo Alto Networks Unit 42","type":"research","credibility":2},{"url":"https://www.itpro.com/security/malware/shai-hulud-here-we-go-again-thousands-of-npm-packages-compromised-in-chaindrop-malware-campaign-where-hackers-taunt-victims","name":"'Shai-Hulud: Here We Go Again': Thousands of npm packages compromised in ChainDrop campaign - IT Pro","type":"news_article","credibility":2},{"url":"https://www.reversinglabs.com/blog/shai-hulud-worm-npm","name":"Shai-Hulud npm supply chain attack: What you need to know - ReversingLabs","type":"research","credibility":2},{"url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/","name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack - Orca Security","type":"research","credibility":2}],"severity":"high"},{"content":"The August 4, 2026 attack originated with the compromise of the GitHub account of Jared Wray (handle: jaredwray), maintainer of the keyv key-value storage library (reported at over 150 million weekly downloads) and the cacheable caching framework. At 09:02:37 UTC, attackers pushed a poisoned commit (hash ee2681a) directly to the main branch of the jaredwray/keyv monorepo, injecting a 29,918-byte obfuscated dropper (setup.mjs) and a 727,680-byte second-stage worm payload (Math_Symbol.js). Malicious commits were also pushed to related repositories including cacheable, flat-cache, file-entry-cache, cacheable-request and cache-manager. Repository hooks were planted in .claude/settings.json and .vscode/tasks.json; StepSecurity and Snyk describe these as planted alongside the initial commit, while Datadog Security Labs records GitHub Actions bot commits adding the hooks at 09:04 UTC. A cover test was deleted at 09:23:50 UTC to reduce the detection surface. The projects' own GitHub Actions release workflows then built and published the malicious artifacts, producing cryptographically valid SLSA Build Level 3 provenance attestations and Sigstore signatures indistinguishable from legitimate releases; the first malicious release, keyv@6.0.0, appeared at 09:35:00 UTC. Because the infected packages carried legitimate provenance metadata, automated provenance-based supply-chain gates did not block the initial spread.\n\nWray confirmed via X that his account was compromised and stated that he used OpenID Connect (OIDC) with npm and one-time codes for GitHub, meaning no long-lived static token was in use; he reported regaining access at approximately 20:00 UTC and beginning a full audit. The precise method of account compromise (phishing, credential stuffing or session token theft) had not been publicly confirmed by npm, GitHub or the maintainer at the time of reporting. One input page noted an allegation that a phishing email using a fake npm support domain (npmjs.help) was used to steal 2FA credentials; this claim was not verified in the primary security research reviewed and remains alleged.","heading":"Initial Compromise Vector","sources":[{"url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/","name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","credibility":2},{"url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign","name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign - Chainguard","type":"research","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/","name":"Massive ChainDrop npm supply-chain attack infects hundreds of packages - BleepingComputer","type":"news_article","credibility":2},{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","name":"ChainDrop: Inside a Self-Propagating npm Worm - Palo Alto Networks Unit 42","type":"research","credibility":2},{"url":"https://semgrep.dev/blog/2026/its-not-npm-ver-yet-npm-worm-chaindrop-hits-400-packages-including-jaredwray-servicetitan-ornikar-qlik-and-nebulajs/","name":"It's not npm-ver yet: NPM worm Chaindrop hits 400+ packages - Semgrep","type":"research","credibility":2},{"url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/","name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack - Orca Security","type":"research","credibility":2},{"url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","name":"Worm compromises hundreds of popular npm packages - Datadog Security Labs","type":"research","credibility":2}],"severity":"critical"},{"content":"The infection chain operates in two stages. Stage 1 (setup.mjs; math_init.js is also reported as a loader filename) is wired into the package's preinstall lifecycle hook ('preinstall': 'node setup.mjs' in package.json) and executes automatically on npm install with no further user interaction. Rather than shipping platform-specific binaries, it detects or downloads the official Bun JavaScript runtime (v1.3.13) from the legitimate oven-sh/bun GitHub releases endpoint, without cryptographic verification, so the traffic appears to come from github.com and evades many network-level detections; running Stage 2 under Bun may also bypass Node.js-specific monitoring. Temporary directories prefixed bun-dl- are created during the download.\n\nReports differ on the size of the Stage 1 loader: Snyk and StepSecurity give setup.mjs as 29,918 bytes and another input page (citing Datadog, JFrog, Snyk and Wiz) as approximately 11-30 KB, whereas the IOC list citing Unit 42, Semgrep and Mallory gives two loader variants of 757,598 bytes (Loader A, SHA-256 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668, the same hash other sources give for setup.mjs) and 738,697 bytes (Loader B, SHA-256 fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb).\n\nStage 2 (Math_Symbol.js, also seen as math_init.js; approximately 710-728 KB, with the initial keyv sample measured at 727,680 bytes) is a heavily obfuscated Bun bundle using control-flow flattening, Base91 encoding with permuted alphabets, and a custom position-dependent substitution cipher (PBKDF2-HMAC-SHA256) for string obfuscation. Its SHA-256 hash is 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc. The malware is cross-platform (Linux, macOS and Windows). A single-instance PID lock file at /tmp/tmp.dpkg_14527.lock and a _NODE_RUNTIME_INIT=1 environment flag prevent re-execution, and empty signal handlers swallow exceptions to avoid crash-based detection.","heading":"Payload and Execution Chain","sources":[{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","credibility":2},{"url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/","name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","name":"Worm compromises hundreds of popular npm packages - Datadog Security Labs","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","name":"ChainDrop: Inside a Self-Propagating npm Worm - Palo Alto Networks Unit 42","type":"research","credibility":2},{"url":"https://semgrep.dev/blog/2026/its-not-npm-ver-yet-npm-worm-chaindrop-hits-400-packages-including-jaredwray-servicetitan-ornikar-qlik-and-nebulajs/","name":"It's not npm-ver yet: NPM worm Chaindrop hits 400+ packages - Semgrep","type":"research","credibility":2},{"url":"https://mallory.ai/stories/019fcc7f-9d0e-744a-8393-d8c22cca90e4","name":"ChainDrop npm Worm Compromises Packages via Preinstall Credential Harvester - Mallory","type":"research","credibility":2}],"severity":"critical"},{"content":"The Stage 2 payload is an aggressive credential harvester. Reports differ on its breadth: over 100 credential file paths according to Wiz and JFrog, more than 300 distinct credential patterns according to Unit 42, and 290 Linux, 129 macOS and 50 Windows file path patterns according to Datadog and JFrog.\n\nCryptocurrency targets: the payload explicitly targets local crypto keystores including Foundry wallet files, Solana CLI keypairs and Monero wallet configurations; Unit 42 confirmed it scans for wallet.dat files associated with the Bitcoin, Dash, Dogecoin, Litecoin and Zcash core clients as well as Electrum wallet files; and it collects cryptocurrency wallet credentials and seed phrases. It also sweeps .env files and shell histories, which frequently contain hardcoded private keys and seed phrases in developer project directories.\n\nOther targets: GitHub Actions runner process memory read via /proc/pid/mem (on Linux with sudo access) to extract temporary OIDC tokens and publishing credentials; runner secrets via the instance metadata endpoints 169.254.169.254 and 169.254.170.2; cloud credentials for AWS (profiles, environment variables, instance metadata, Secrets Manager), Azure, GCP, Alibaba, Tencent and Hetzner; Kubernetes service-account tokens and kubeconfigs; HashiCorp Vault tokens (including VAULT_TOKEN) and KV mounts across 17 regions; SSH private keys; GitHub PATs, OAuth tokens, GitHub Apps credentials, JWTs and session tokens; npm tokens (.npmrc), including tokens with bypass_2fa; PyPI and RubyGems credentials; Terraform state files; Docker and Helm configurations; Stripe and Slack API keys; browser credential stores and local password vaults (1Password, Bitwarden); and AI coding tool credentials for Claude Code (Anthropic API keys), OpenAI/Codex, Cursor, Gemini and VS Code.\n\nStolen data is JSON-serialized, gzip-compressed and AES-256-GCM encrypted, with the symmetric key wrapped by an RSA (RSA-OAEP) public key. Exfiltration channels include direct HTTPS POST to C2 domains and attacker-created public GitHub repositories with Dune-themed names (sardaukar, fremen, atreides, sandworm, melange) and the default description 'Shai-Hulud: Here We Go Again.' A persistence component called gh-token-monitor acts as a dead-man switch: it polls the GitHub API every 60 seconds and, when a stolen GitHub token is revoked, alerts the attackers and evaluates remotely supplied commands. Responders are advised to remove it before revoking tokens.","heading":"Credential Harvesting and Cryptocurrency Wallet Targeting","sources":[{"url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","name":"ChainDrop: Inside a Self-Propagating npm Worm - Palo Alto Networks Unit 42","type":"research","credibility":2},{"url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","name":"Worm compromises hundreds of popular npm packages - Datadog Security Labs","type":"research","credibility":2},{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","credibility":2},{"url":"https://coinalertnews.com/news/2026/05/20/mini-shai-hulud-npm-attack","name":"Mini Shai-Hulud Attack Compromises 323 npm Packages in 30 Minutes, Threatening Blockchain Developer Credentials - CoinAlertNews","type":"news_article","credibility":3},{"url":"https://www.kucoin.com/news/flash/shai-hulud-malware-infects-npm-pypi-packages-threatens-crypto-wallets","name":"Shai-Hulud Malware Infects NPM/PyPI Packages, Threatens Crypto Wallets - KuCoin","type":"news_article","credibility":2},{"url":"https://www.techtimes.com/articles/323089/20260805/keyv-npm-supply-chain-attack-hides-malware-ai-agent-files-scanners-never-read.htm","name":"keyv npm Supply Chain Attack Hides Malware in AI Agent Files Scanners Never Read - TechTimes","type":"news_article","credibility":3},{"url":"https://zerohunt.ai/blog/chaindrop-npm-worm-claude-code-hooks/","name":"ChainDrop: the npm worm that steals your AI assistant's credentials - Zero Hunt","type":"research","credibility":2}],"severity":"critical"},{"content":"ChainDrop's most notable technical innovation is its use of Ethereum mainnet for C2 domain resolution. Rather than hardcoding an exfiltration domain, the payload queries a StringListStore smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103 (function selector 0x53ed5143) through a pool of public RPC endpoints, including eth-mainnet.nodereal.io, go.getblock.io and eth.llamarpc.com. Reports differ on the pool size: up to 75 endpoints according to Elastic, StepSecurity and JFrog, and 73 according to Datadog, JFrog and Socket. The contract's return value is the active exfiltration domain; at the time of Elastic Security Labs' analysis it returned npm-cache[.]com. Known C2 endpoints include awqhnjewqjkl[.]icu:443/router, pypi-get[.]com:443/router, js-mirror[.]com:443/router and npm-cache[.]com:443/router, the last registered on 2026-05-22; Unit 42 dates deployment of ChainDrop C2 infrastructure to May 22, 2026.\n\nThis design lets the operator rotate C2 infrastructure by updating on-chain state without modifying or republishing the worm, making domain sinkholing and takedown far harder. On August 4, 2026, the attackers rotated the C2 infrastructure through a single Ethereum transaction (hash 0xc55920f1...), adding awqhnjewqjkl[.]icu, without changing deployed malware. The operator wallet associated with the contract is 0x55f9780e...f31cD. Unit 42 reported traffic to the C2 infrastructure from environments on four continents after the rotation.\n\nIf blockchain resolution fails, the worm falls back to a GitHub dead-drop, searching for a signed marker string (thebeautifulmarchoftime or thebeautifulsnadsoftime) and accepting a C2 domain only after validating it against an embedded RSA-4096 public key. Sources differ on where it searches: GitHub commit history according to Elastic, StepSecurity and Unit 42, and GitHub repository descriptions according to Datadog, JFrog and Socket, which reported approximately 1,300 GitHub repositories carrying the marker at peak. As a final fallback it exfiltrates collected data to a public GitHub repository created in the compromised victim's own account with the description 'Shai-Hulud: Here We Go Again.' The persistence commit marker 'IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients' was also found in some injected commits.","heading":"Ethereum Blockchain Command-and-Control (EtherHiding)","sources":[{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","name":"ChainDrop: Inside a Self-Propagating npm Worm - Palo Alto Networks Unit 42","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","credibility":2},{"url":"https://www.itpro.com/security/malware/shai-hulud-here-we-go-again-thousands-of-npm-packages-compromised-in-chaindrop-malware-campaign-where-hackers-taunt-victims","name":"'Shai-Hulud: Here We Go Again': Thousands of npm packages compromised in ChainDrop campaign - IT Pro","type":"news_article","credibility":2},{"url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","name":"Worm compromises hundreds of popular npm packages - Datadog Security Labs","type":"research","credibility":2},{"url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain","name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack - Socket","type":"research","credibility":2}],"severity":"critical"},{"content":"ChainDrop's self-propagation distinguishes it from conventional supply-chain compromises. After harvesting npm tokens from a victim environment (in particular tokens with the bypass_2fa flag and package write permissions), the payload validates the tokens against the registry, enumerates every package they can publish, downloads the current clean tarballs, injects the identical preinstall hook and Stage 1/Stage 2 files, increments the patch version and republishes the trojanized package to npm. For stolen GitHub tokens, it commits the .claude/settings.json and .vscode/tasks.json persistence hooks to accessible repository branches. The worm also attempted to generate fresh Sigstore SLSA provenance for republished packages via a narrow gate targeting the opensearch-js repository's trusted publishing configuration, so some propagated packages carried valid provenance attestations. No further attacker interaction was required after the initial keyv compromise; the malware moved between organizations every two to seven minutes during propagation.\n\nReports differ on how long the propagation took. StepSecurity, Elastic and others report that within about four hours of the first malicious commit (by 13:20 UTC according to Elastic) the worm had poisoned 444 packages and 2,212 versions across more than 14 victim organizations, with the automated second wave starting at about 09:38 UTC. Aikido, Socket and Orca describe the cross-organization publishing burst as completing in approximately 30 minutes, and The Hacker News places the end of the burst at around 10:39 UTC with approximately 2,234 poisoned versions across 444 packages. Datadog reports that nine additional packages under the maintainer's account were trojanized within roughly 40 minutes of the start.","heading":"Self-Propagation Mechanism","sources":[{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","credibility":2},{"url":"https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack","name":"Keyv and friends compromised in npm supply chain attack - Aikido Security","type":"research","credibility":2},{"url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain","name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack - Socket","type":"research","credibility":2},{"url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/","name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack - Orca Security","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html","name":"Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks - The Hacker News","type":"news_article","credibility":2},{"url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","name":"Worm compromises hundreds of popular npm packages - Datadog Security Labs","type":"research","credibility":2},{"url":"https://www.infosecurity-magazine.com/news/chaindrop-worm-400-npm-two-billion/","name":"ChainDrop Worm Hits 400 npm Packages with Two Billion Monthly Installs - Infosecurity Magazine","type":"news_article","credibility":2},{"url":"https://expel.com/blog/chaindrop-the-mini-shai-hulud-npm-worms-latest-wave-hits-keyv-and-cacheable/","name":"ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheable - Expel","type":"research","credibility":2}],"severity":"critical"},{"content":"The directly compromised core packages (malicious versions) were published between 09:35 and 10:28 UTC on August 4, 2026 through the legitimate GitHub Actions trusted publishing workflow, with valid SLSA provenance: keyv@6.0.0 (the initial vector), flat-cache@6.1.24, file-entry-cache@11.1.6, cacheable-request@13.0.20, cache-manager@7.2.10, cacheable@2.5.1, @cacheable/memory@2.2.1, @cacheable/utils@2.5.1, @cacheable/node-cache@3.1.2, @cacheable/net@2.1.1 and ecto@5.0.1. The survivor page described these as eleven releases 'across eight package names', while the list itself contains eleven package names. Reported download volumes at the time of compromise: keyv 153.7 million weekly (Snyk/StepSecurity/Expel), over 150 million weekly (Unit 42/Semgrep) or 127 million weekly (CybersecurityNews), and over 600 million or approximately 604 million monthly; flat-cache 149.9 million weekly, or approximately 565-580 million monthly; file-entry-cache 147.6 million weekly, or approximately 557-571 million monthly; cacheable-request 34 million weekly or approximately 137 million monthly; cache-manager 4.3 million weekly or approximately 16 million monthly; cacheable approximately 30 million monthly; @cacheable/memory approximately 28 million monthly; @cacheable/utils approximately 34 million monthly; @cacheable/node-cache approximately 6 million monthly; @cacheable/net approximately 3,700 monthly; ecto approximately 4,500 monthly. Because keyv is a transitive dependency of many tools, the blast radius extended well beyond direct dependents.\n\nTotal scale estimates vary by source and reporting time: 444 packages and 2,212 versions (StepSecurity, Elastic, SecurityWeek); 444 to 452 packages; 444 packages and 2,234 versions (The Hacker News and others); 420 to 868 package names; and 1,381 to 2,234 poisoned versions (Aikido). Later tallies cite more than 1,300, described as package versions by CyberWorldOps and as packages by TechRadar. Combined exposure is estimated at approximately two billion monthly downloads.\n\nThe second propagation wave hit namespaces including @servicetitan, @onereach (78 packages), @or-sdk (74) and @ornikar (42). Reports differ on @servicetitan: 141 packages according to StepSecurity-cited reporting, and approximately 300 according to another input page. Confirmed affected organizations include Deliveroo, Ornikar, OneReach, Picsart, Qlik (including the Nebula.js visualization library) and ServiceTitan; the OpenSearch project was also targeted through GitHub Actions OIDC token abuse. The maintainer's account alone had write access to packages totalling over two billion monthly downloads, making it a high-value single point of failure.","heading":"Scale, Affected Packages and Organizations","sources":[{"url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/","name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://expel.com/blog/chaindrop-the-mini-shai-hulud-npm-worms-latest-wave-hits-keyv-and-cacheable/","name":"ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheable - Expel","type":"research","credibility":2},{"url":"https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack","name":"Keyv and friends compromised in npm supply chain attack - Aikido Security","type":"research","credibility":2},{"url":"https://safedep.io/keyv-npm-supply-chain-compromise/","name":"keyv and cacheable npm compromise: 400+ packages - SafeDep","type":"research","credibility":2},{"url":"https://cybersecuritynews.com/keyv-npm-package-compromised/","name":"Keyv npm Package with 127M Weekly Downloads Compromised in Shai-Hulud Attack - CybersecurityNews","type":"news_article","credibility":2},{"url":"https://www.sourcetrail.com/javascript/npm/chaindrop-attack-over-435-npm-packages-compromised-in-supply-chain-worm/","name":"ChainDrop Attack: 435 npm Packages Compromised in Supply Chain Worm - Sourcetrail","type":"news_article","credibility":2},{"url":"https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/","name":"Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack - SecurityWeek","type":"news_article","credibility":1},{"url":"https://cyberworldops.eu/en/chaindrop-the-npm-supply-chain-attack-that-compromised-1300-packages","name":"ChainDrop npm Attack Hits 1,300 Packages - CyberWorldOps","type":"news_article","credibility":2},{"url":"https://www.techradar.com/pro/security/new-chaindrop-worm-poisons-over-1-300-npm-packages-keyv-and-cacheable-among-those-hit","name":"New ChainDrop worm poisons over 1,300 npm packages - TechRadar","type":"news_article","credibility":2},{"url":"https://www.infosecurity-magazine.com/news/chaindrop-worm-400-npm-two-billion/","name":"ChainDrop Worm Hits 400 npm Packages with Two Billion Monthly Installs - Infosecurity Magazine","type":"news_article","credibility":2},{"url":"https://www.ox.security/blog/a-new-infostealer-worm-hits-npm-affecting-keyv-and-cacheable/","name":"A Massive Shai-Hulud Campaign Hits npm: +440 Packages Compromised - OX Security","type":"research","credibility":2},{"url":"https://semgrep.dev/blog/2026/its-not-npm-ver-yet-npm-worm-chaindrop-hits-400-packages-including-jaredwray-servicetitan-ornikar-qlik-and-nebulajs/","name":"It's not npm-ver yet: NPM worm Chaindrop hits 400+ packages - Semgrep","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","credibility":2}],"severity":"critical"},{"content":"A notable evolution relative to earlier Shai-Hulud variants is the planting of persistence hooks in developer IDEs and AI coding agents. Malicious configurations are written to .claude/settings.json (registering a SessionStart command that runs when a Claude Code session starts), .vscode/tasks.json (using runOn: 'folderOpen' to execute when the project is opened in VS Code) and corresponding .mjs loader files. These hooks run the worm whenever a developer opens an infected repository, independent of any npm install, so credential theft can persist and recur after the malicious package versions are removed from lock files, as long as the infected repository files remain on disk. ZeroHunt researchers noted that the hooks are timed to align with developer workflows, maximizing the window in which CI/CD runner memory can be scraped for active OIDC tokens. Worm-authored commits use the author name 'claude' (email claude@users.noreply.github.com) with the message 'chore: update config'. Snyk classified the behaviour as CWE-506 (embedded malicious code) with critical severity.","heading":"IDE and AI Coding Agent Persistence","sources":[{"url":"https://zerohunt.ai/blog/chaindrop-npm-worm-claude-code-hooks/","name":"ChainDrop: the npm worm that steals your AI assistant's credentials - Zero Hunt","type":"research","credibility":2},{"url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/","name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","credibility":2},{"url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","name":"Worm compromises hundreds of popular npm packages - Datadog Security Labs","type":"research","credibility":2},{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","credibility":2}],"severity":"critical"},{"content":"ChainDrop showed that SLSA Build Level 3 provenance attestation does not protect against repository-level compromise. Because the malicious source was committed before the build workflow ran, the resulting npm packages received cryptographically valid attestations generated by GitHub Actions' OIDC trusted publisher; the attestation accurately reflects that the package was built from the published source by the expected workflow but cannot detect that the source itself was modified. As Chainguard put it, 'Provenance and attestation prove who published a package, not that the publisher's environment was trustworthy'; Socket similarly noted that 'provenance attests build integrity, not source integrity.' The worm's ability to generate fresh Sigstore provenance for some republished packages further undermines verification-based defenses. Additional evasion techniques include payload minimalism (only three files added per package, with compiled artifacts byte-identical to clean versions), the Bun runtime download disguised as routine GitHub release traffic, position-dependent PBKDF2-HMAC-SHA256 string obfuscation, gzip and AES-256-GCM encryption of payload contents, and process detachment flags that hinder detection via standard process monitoring.","heading":"SLSA Provenance Bypass and Evasion Techniques","sources":[{"url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/","name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","credibility":2},{"url":"https://thenextweb.com/news/chaindrop-npm-worm-shai-hulud-provenance-ai-tools","name":"ChainDrop: the npm worm that faked being legitimate - The Next Web","type":"news_article","credibility":2},{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages - StepSecurity","type":"research","credibility":2},{"url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign","name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign - Chainguard","type":"research","credibility":2},{"url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain","name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack - Socket","type":"research","credibility":2}],"severity":"high"},{"content":"Socket's automated scanner flagged the malicious code in keyv@6.0.0 approximately 5 minutes and 18 seconds after publication, and community members posted warnings about unexpected hooks in the keyv repository within the first 10 minutes. Public warnings spread across security channels at approximately 10:18-10:20 UTC. Elastic Security Labs identified and reported the campaign at approximately 5:39 AM EST. npm began unpublishing affected versions at approximately 10:39 UTC on August 4, less than two hours after the first malicious release, with cleanup substantially complete by 18:10 UTC; previous clean versions were restored as 'latest' for at least nine primary packages by approximately 17:40 IST. The keyv maintainer republished version 6.0.0 with clean code using npm Trusted Publishers and SLSA provenance protections.\n\nMicrosoft's security research team (credited: Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan) published a primary technical analysis on August 4, 2026, and Wiz, Unit 42, StepSecurity, Expel and others published independent analyses with IOCs and remediation guidance. The Cyber Security Agency of Singapore issued Advisory AD-2026-009 on the attack affecting keyv and related packages, and NHS England Digital issued Cyber Alert CC-4781 on the supply-chain attack affecting npm and PyPI packages. CISA was reported to have flagged the campaign in security briefings, but no dedicated CISA advisory specific to ChainDrop has been confirmed. Snyk assigned advisory SNYK-JS-KEYV-18515941 (CWE-506). No CVE had been assigned to the ChainDrop wave at the time of the input research; CVE-2026-45321 (CVSS 9.6) was previously assigned to the May 2026 TanStack wave of Mini Shai-Hulud. JFrog customers using Curation immaturity policies received automatic protection within 24 hours.","heading":"Detection, Registry Response and Advisories","sources":[{"url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain","name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack - Socket","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html","name":"Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks - The Hacker News","type":"news_article","credibility":2},{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","credibility":2},{"url":"https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/","name":"Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages (Shai-Hulud Worm) - Cyber Security Agency of Singapore","type":"regulatory","credibility":1},{"url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4781","name":"Supply Chain Attack Affecting Numerous npm and PyPI Packages - NHS England Digital","type":"regulatory","credibility":1},{"url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/","name":"ChainDrop supply chain compromise: Anatomy of a self-propagating worm - Microsoft Security Blog","type":"research","credibility":1},{"url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions","name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ - Tenable","type":"research","credibility":2},{"url":"https://rodtrent.substack.com/p/security-check-in-quick-hits-cisa","name":"Security Check-in: CISA Flags ChainDrop npm Worm - Rod Trent Substack","type":"news_article","credibility":3},{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","credibility":2}],"severity":"high"},{"content":"File artifacts: setup.mjs and Math_Symbol.js (initial wave) and math_init.js (second wave) in package directories, wired to a preinstall hook. Hashes: setup.mjs / Loader A SHA-256 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668; Loader B SHA-256 fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb; Math_Symbol.js / math_init.js SHA-256 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc. Lock file /tmp/tmp.dpkg_14527.lock (active or recent execution); temporary Bun download directories /tmp/bun-dl-*.\n\nPersistence paths: .claude/settings.json (with a SessionStart hook), .claude/setup.mjs, .claude/math_init.js, .vscode/tasks.json (with runOn: 'folderOpen'), .vscode/setup.mjs. Worm-authored commits by author 'claude' / claude@users.noreply.github.com with message 'chore: update config' in repositories not owned by Anthropic; branch name dependabot/github_actions/format/setup-formatter.\n\nNetwork: Bun runtime downloads from github.com/oven-sh/bun/releases during npm install; User-Agent Bun/1.3.13; outbound connections to npm-cache[.]com, pypi-get[.]com, js-mirror[.]com and awqhnjewqjkl[.]icu; Ethereum JSON-RPC traffic to eth-mainnet.nodereal.io, go.getblock.io and eth.llamarpc.com; queries to contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103 (selector 0x53ed5143), which can also be monitored for new transactions to surface future C2 rotations.\n\nGitHub and registry: markers thebeautifulmarchoftime and thebeautifulsnadsoftime; exfiltration repositories with description 'Shai-Hulud: Here We Go Again' and Dune-themed names (sardaukar, fremen, atreides, sandworm, melange); malicious npm releases lacking npmVersion and nodeVersion metadata fields; unexpected npm publish events outside normal release cadence.","heading":"Indicators of Compromise","sources":[{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","name":"ChainDrop: Inside a Self-Propagating npm Worm - Palo Alto Networks Unit 42","type":"research","credibility":2},{"url":"https://semgrep.dev/blog/2026/its-not-npm-ver-yet-npm-worm-chaindrop-hits-400-packages-including-jaredwray-servicetitan-ornikar-qlik-and-nebulajs/","name":"It's not npm-ver yet: NPM worm Chaindrop hits 400+ packages - Semgrep","type":"research","credibility":2},{"url":"https://mallory.ai/stories/019fcc7f-9d0e-744a-8393-d8c22cca90e4","name":"ChainDrop npm Worm Compromises Packages via Preinstall Credential Harvester - Mallory","type":"research","credibility":2},{"url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","name":"Worm compromises hundreds of popular npm packages - Datadog Security Labs","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","credibility":2}],"severity":"high"},{"content":"Any system or CI/CD runner on which an affected version was installed should be treated as fully compromised. Recommended steps drawn from multiple advisories: (1) Scan package-lock.json, yarn.lock and pnpm-lock.yaml for affected versions (IOC tables published by Wiz, JFrog and Snyk), remove them from all environments, purge lockfiles and package manager caches, and pin to known-clean versions, e.g. keyv 5.6.0 (before 6.0.0), flat-cache 6.1.23, cache-manager 7.2.9, cacheable-request 13.0.19. (2) Remove the gh-token-monitor persistence component before revoking GitHub tokens, since the dead-man switch alerts the attacker to revocation. (3) Rotate every credential present in the environment, prioritising npm tokens with publish or bypass_2fa permissions, GitHub PATs, OAuth tokens and GitHub Apps credentials, GitHub Actions OIDC configurations, AWS keys, Azure and GCP credentials, Kubernetes service-account tokens, HashiCorp Vault tokens, SSH private keys, Stripe, Slack and other API keys, and any cryptocurrency wallet private keys or seed phrases stored on disk or in environment variables; any machine that installed an affected version should be assumed to have had wallet.dat, Electrum wallet files, .env files and shell histories exfiltrated. (4) Audit all branches for the five hook files (.vscode/tasks.json, .vscode/setup.mjs, .claude/math_init.js, .claude/settings.json, .claude/setup.mjs) and search GitHub audit logs for the commit message 'chore: update config', the branch dependabot/github_actions/format/setup-formatter and commits from claude@users.noreply.github.com. (5) Audit packages your team published after August 4 for unexpected preinstall hooks or payload files. (6) Block the C2 domains at the DNS or TLS-SNI layer / network perimeter. (7) Rebuild CI/CD runners from clean images rather than relying on in-place remediation or credential rotation alone. (8) Review npm trusted publishers and GitHub OIDC configurations, enable two-factor authentication on npm and GitHub, and consider soak periods or dependency allowlisting before adopting new versions. (9) Upgrade to npm 12 or later, which does not execute preinstall lifecycle hooks by default and would have blocked the payload.","heading":"Remediation Guidance","sources":[{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","credibility":2},{"url":"https://insights.integrity360.com/threat-advisories/chaindrop-the-keyv-and-cacheable-npm-supply-chain-attack","name":"ChainDrop: The Keyv and Cacheable npm Supply Chain Attack - Integrity360","type":"research","credibility":2},{"url":"https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/","name":"Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages (Shai-Hulud Worm) - Cyber Security Agency of Singapore","type":"regulatory","credibility":1},{"url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/","name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack - Orca Security","type":"research","credibility":2},{"url":"https://strobes.co/blog/keyv-cacheable-npm-supply-chain-attack/","name":"keyv and cacheable npm Supply Chain Attack: What to Do - Strobes","type":"research","credibility":2},{"url":"https://cloudsmith.com/blog/keyv-and-cacheable-npm-packages-compromised-in-active-supply-chain-attack","name":"Keyv and Cacheable npm Packages Compromised in Active Supply-Chain Attack - Cloudsmith","type":"research","credibility":2},{"url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain","name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack - Socket","type":"research","credibility":2}],"severity":"high"},{"content":"ChainDrop is the largest documented wave of a campaign series that began in September 2025. Earlier waves include the original Shai-Hulud worm (September 2025), SHA1-Hulud (November 2025), an initial campaign documented in Microsoft's December 2025 'Shai-Hulud 2.0' guidance, and SANDWORM_MODE (March 2026). Sources differ on when Mini Shai-Hulud began: Tenable dates its operations from April 2026 (introducing SLSA provenance forgery, OIDC token extraction from runner memory and AI-agent persistence hooks), while another input page describes it as a resurgence identified in May 2026 that compromised more than 170 npm packages and two PyPI packages across 404 malicious versions.\n\nOn May 11, 2026, TeamPCP compromised TanStack's GitHub Actions CI pipeline via OIDC token theft and published 84 malicious versions across 42 @tanstack/* packages in about six minutes (CVE-2026-45321, CVSS 9.6). On May 12, 2026, TeamPCP open-sourced the Shai-Hulud worm on GitHub under an MIT License; Akamai reports the message 'Shai-Hulud: Open Sourcing The Carnage' together with a $1,000 contest for the largest supply-chain attack using the code, while Pluto Security reports the release description 'A Gift From TeamPCP'. Researchers assess the release substantially lowered the barrier for copycat attacks. On May 18, 2026 a copycat worm infected at least one further npm package (The Register). On May 19, 2026 the @antv ecosystem (Alibaba's data visualization stack) was hit through a stolen maintainer account, with 639 malicious versions across 323 packages published in under 30 minutes (another page gives 324 packages); Socket detected most within 6.7 minutes. In June 2026 a variant infected Red Hat npm packages downloaded about 80,000 times per week. Confirmed victims across Mini Shai-Hulud waves include OpenAI, Mistral AI, the European Commission and GitHub, and over 2,500 compromised GitHub repositories were reported at peak, across both npm and PyPI.","heading":"Prior Campaign History (Shai-Hulud Family)","sources":[{"url":"https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html","name":"Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages - The Hacker News","type":"news_article","credibility":2},{"url":"https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public","name":"Mini Shai-Hulud: The Worm Returns and Goes Public - Akamai","type":"research","credibility":2},{"url":"https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/","name":"TeamPCP / Mini Shai-Hulud npm Campaign: 600 Packages, Confirmed Active Payload - Phoenix Security","type":"research","credibility":2},{"url":"https://cybersecuritynews.com/600-npm-packages-compromised/","name":"600+ npm Packages Compromised in New Mini Shai-Hulud Supply Chain Attack - CybersecurityNews","type":"news_article","credibility":2},{"url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions","name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ - Tenable","type":"research","credibility":2},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","name":"Shai-Hulud 2.0: Guidance for detecting, investigating, and defending - Microsoft Security Blog (December 2025)","type":"research","credibility":1},{"url":"https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/","name":"Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised - SafeDep","type":"research","credibility":2},{"url":"https://www.theregister.com/cyber-crime/2026/05/18/shai-hulud-copycat-hits-another-npm-package/5242180","name":"Shai-Hulud copycat worm infects yet another npm package - The Register","type":"news_article","credibility":2},{"url":"https://www.theregister.com/security/2026/06/01/shai-hulud-malware-infects-red-hat-npm-packages-downloaded-80k-times-weekly/5249803","name":"Shai-Hulud malware worms Red Hat npm package - The Register","type":"news_article","credibility":2},{"url":"https://www.reversinglabs.com/blog/shai-hulud-worm-npm","name":"Shai-Hulud npm supply chain attack: What you need to know - ReversingLabs","type":"research","credibility":2},{"url":"https://teampcp.pluto.security/","name":"TeamPCP - The supply chain attack story so far - Pluto Security","type":"research","credibility":2},{"url":"https://snyk.io/blog/tanstack-npm-packages-compromised/","name":"TanStack npm Packages Hit by Mini Shai-Hulud - Snyk","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages - StepSecurity","type":"research","credibility":2}],"severity":"high"}],"timeline":[{"date":"2025-09","event":"Original Shai-Hulud worm debuts, marking the start of the systematic npm/PyPI supply-chain campaign series.","source":"Tenable Mini Shai-Hulud FAQ","source_url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"date":"2025-11","event":"SHA1-Hulud variant introduced with enhanced capabilities.","source":"Tenable Mini Shai-Hulud FAQ","source_url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"date":"2025-11","event":"TeamPCP threat group first observed conducting cloud-native cryptomining and credential theft campaigns.","source":"Pluto Security - TeamPCP: The supply chain attack story so far","source_url":"https://teampcp.pluto.security/"},{"date":"2025-12-09","event":"Microsoft Security Research publishes Shai-Hulud 2.0 guidance documenting an earlier wave of the campaign.","source":"Microsoft Security Blog","source_url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","date_evidence":"Publication date in the source URL path (/2025/12/09/)."},{"date":"2026-03","event":"SANDWORM_MODE iteration of the worm introduced.","source":"Tenable Mini Shai-Hulud FAQ","source_url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"date":"2026-03","event":"TeamPCP force-pushes 76 of 77 Trivy GitHub Action tags with the SANDCLOCK credential stealer; CanisterWorm infects 66+ npm packages using ICP blockchain C2.","source":"Palo Alto Unit 42 - Weaponizing the Protectors","source_url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"date":"2026-04","event":"Mini Shai-Hulud (fourth generation) begins operations according to Tenable, introducing SLSA provenance forgery, OIDC token extraction from runner memory and AI-agent persistence hooks.","source":"Tenable Mini Shai-Hulud FAQ","source_url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"date":"2026-04-02","event":"CERT-EU attributes the breach of the European Commission's AWS environment to TeamPCP.","source":"Pluto Security - TeamPCP: The supply chain attack story so far","source_url":"https://teampcp.pluto.security/","date_evidence":"Input page text: 'On April 2-3, 2026, CERT-EU officially attributed the breach of the European Commission's AWS environment to TeamPCP.'"},{"date":"2026-05","event":"A Mini Shai-Hulud resurgence is identified compromising over 170 npm packages and two PyPI packages across 404 malicious versions.","source":"SafeDep / Microsoft Security Research","source_url":"https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/"},{"date":"2026-05-11","event":"TanStack attack: 84 malicious versions across 42 @tanstack/* packages published in about six minutes via OIDC token theft; CVE-2026-45321 (CVSS 9.6) assigned.","source":"StepSecurity - TeamPCP Mini Shai-Hulud TanStack","source_url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","date_evidence":"Input page text: 'On May 11, 2026, TeamPCP compromised the GitHub Actions CI pipeline of TanStack'."},{"date":"2026-05-12","event":"TeamPCP open-sources the Shai-Hulud worm under an MIT License ('Shai-Hulud: Open Sourcing The Carnage' per Akamai; 'A Gift From TeamPCP' per Pluto Security) and announces a $1,000 contest for the largest supply-chain attack using the code.","source":"Akamai - Mini Shai-Hulud: The Worm Returns and Goes Public","source_url":"https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public","date_evidence":"Input page text: 'On May 12, 2026, TeamPCP open-sourced the Shai-Hulud worm on GitHub under an MIT License'."},{"date":"2026-05-18","event":"A Shai-Hulud copycat worm infects at least one additional npm package.","source":"The Register","source_url":"https://www.theregister.com/cyber-crime/2026/05/18/shai-hulud-copycat-hits-another-npm-package/5242180","date_evidence":"Publication date in the source URL path (/2026/05/18/)."},{"date":"2026-05-19","event":"@antv ecosystem attack: 639 malicious versions across 323 packages published in under 30 minutes via a stolen maintainer account; Socket detects most within 6.7 minutes.","source":"SafeDep - Mini Shai-Hulud Strikes Again","source_url":"https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/","date_evidence":"Input page text: 'On May 19, 2026, the @antv npm ecosystem (Alibaba's data visualization stack) was struck'."},{"date":"2026-05-22","event":"ChainDrop C2 infrastructure deployed; C2 domain npm-cache[.]com registered.","source":"Palo Alto Networks Unit 42","source_url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","date_evidence":"Input page text: 'npm-cache[.]com:443/router (registered 2026-05-22)'."},{"date":"2026-06","event":"Shai-Hulud variant infects Red Hat npm packages downloaded approximately 80,000 times per week.","source":"The Register","source_url":"https://www.theregister.com/security/2026/06/01/shai-hulud-malware-infects-red-hat-npm-packages-downloaded-80k-times-weekly/5249803"},{"date":"2026-08","event":"Wiz, Palo Alto Networks Unit 42, StepSecurity, Expel and other firms publish independent analyses with IOCs and remediation guidance.","source":"Wiz Blog / Unit 42 / StepSecurity","source_url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"},{"date":"2026-08","event":"Cyber Security Agency of Singapore issues Advisory AD-2026-009 on the attack affecting keyv and related packages.","source":"Cyber Security Agency of Singapore","source_url":"https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/"},{"date":"2026-08-04","event":"09:02:37 UTC: attacker uses the compromised jaredwray GitHub account to push poisoned commit ee2681a to the keyv monorepo, injecting setup.mjs and Math_Symbol.js.","source":"StepSecurity - ChainDrop npm Worm","source_url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","date_evidence":"Input page text: 'The August 4, 2026 attack originated with the compromise of the GitHub account of Jared Wray ... At 09:02:37 UTC, attackers pushed a poisoned commit (hash ee2681a)'."},{"date":"2026-08-04","event":"09:04 UTC: GitHub Actions bot commits add .claude/settings.json and .vscode/tasks.json IDE persistence hooks to repository branches.","source":"Datadog Security Labs","source_url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","date_evidence":"Input page timeline and text dating the attack to August 4, 2026."},{"date":"2026-08-04","event":"09:35 UTC: keyv@6.0.0 published via OIDC trusted publishing with a valid SLSA attestation; Socket's scanner flags it about 5 minutes 18 seconds later.","source":"Snyk - Inside the keyv npm Supply Chain Compromise","source_url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/","date_evidence":"Input page text: 'The first malicious release, keyv@6.0.0, appeared at 09:35:00 UTC on August 4, 2026.'"},{"date":"2026-08","event":"09:38 UTC onward: automated second-wave propagation using harvested npm credentials spreads to @servicetitan, @onereach, @or-sdk, @ornikar and other namespaces; by 13:20 UTC, 444 packages and 2,212 versions compromised (Elastic).","source":"Elastic Security Labs","source_url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","date_evidence":"Input page text: 'Within four hours of the first malicious commit at 09:02 UTC on August 4 ...'.","date_original":"2026-08-04"},{"date":"2026-08-04","event":"10:06-10:28 UTC: nine additional Cacheable-family packages and ecto@5.0.1 published in rapid succession.","source":"Datadog Security Labs","source_url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","date_evidence":"Input page text: 'Eleven initial malicious releases ... published between 09:35 and 10:28 UTC on August 4, 2026.'"},{"date":"2026-08","event":"10:18-10:20 UTC: public warnings spread; 10:39 UTC: npm begins unpublishing affected versions (cleanup substantially complete by 18:10 UTC); Elastic reports the campaign at about 5:39 AM EST; clean versions restored as 'latest' for at least nine packages by 17:40 IST.","source":"StepSecurity / The Hacker News","source_url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","date_evidence":"Input page text: 'The npm registry began unpublishing affected versions at approximately 10:39 UTC on August 4'.","date_original":"2026-08-04"},{"date":"2026-08-04","event":"Attackers rotate C2 endpoints via an Ethereum transaction on contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103, adding awqhnjewqjkl[.]icu without modifying deployed malware.","source":"Palo Alto Networks Unit 42","source_url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","date_evidence":"Input page text: 'On August 4, 2026, attackers rotated the entire C2 infrastructure through a single Ethereum transaction'."},{"date":"2026-08-04","event":"Microsoft Security Blog publishes primary technical analysis by Ravikant Tiwari, Sagar Patil and Suriyaraj Natarajan.","source":"Microsoft Security Blog","source_url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/","date_evidence":"Publication date in the source URL path (/2026/08/04/)."},{"date":"2026-08-04","event":"Jared Wray confirms via X that his GitHub account was compromised, reports using OIDC with npm and one-time codes, and says he regained access at about 20:00 UTC.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/","date_evidence":"Input page timeline entry dated 2026-08-04 citing Wray's X post."},{"date":"2026-08","event":"Researchers report total impact of 444+ packages and 1,381-2,234 poisoned versions, with over two billion monthly installs exposed.","source":"Aikido Security","source_url":"https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack","date_evidence":"Input page text: 'By August 5, the attack had affected an estimated 444 distinct npm package names across 2,234 poisoned versions'.","date_original":"2026-08-05"}],"sources_used":[{"url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/","name":"ChainDrop supply chain compromise: Anatomy of a self-propagating worm - Microsoft Security Blog","type":"research","archive_url":"http://web.archive.org/web/20260805194150/https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/","credibility":1,"archive_timestamp":"2026-08-05T19:41:50+00:00"},{"url":"https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/","name":"Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages (Shai-Hulud Worm) - Cyber Security Agency of Singapore","type":"regulatory","archive_url":"https://web.archive.org/web/20260807005056/https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/","credibility":1,"archive_timestamp":"2026-08-07T00:50:56+00:00"},{"url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4781","name":"Supply Chain Attack Affecting Numerous npm and PyPI Packages - NHS England Digital","type":"regulatory","archive_url":"http://web.archive.org/web/20260514182212/https://digital.nhs.uk/cyber-alerts/2026/cc-4781","credibility":1,"archive_timestamp":"2026-05-14T18:22:12+00:00"},{"url":"https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/","name":"Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack - SecurityWeek","type":"news_article","archive_url":"http://web.archive.org/web/20260806032247/https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/","credibility":1,"archive_timestamp":"2026-08-06T03:22:47+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/","name":"Massive ChainDrop npm supply-chain attack infects hundreds of packages - BleepingComputer","type":"news_article","archive_url":"http://web.archive.org/web/20260806094409/https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/","credibility":2,"archive_timestamp":"2026-08-06T09:44:09+00:00"},{"url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm","name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","archive_url":"http://web.archive.org/web/20260806062530/https://www.stepsecurity.io/blog/chaindrop-npm-worm","credibility":2,"archive_timestamp":"2026-08-06T06:25:30+00:00"},{"url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","archive_url":"http://web.archive.org/web/20260806225345/https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain","credibility":2,"archive_timestamp":"2026-08-06T22:53:45+00:00"},{"url":"https://research.jfrog.com/post/shai-hulud-is-back-august/","name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","archive_url":"http://web.archive.org/web/20260804194035/https://research.jfrog.com/post/shai-hulud-is-back-august/","credibility":2,"archive_timestamp":"2026-08-04T19:40:35+00:00"},{"url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/","name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","archive_url":"http://web.archive.org/web/20260804231158/https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/","credibility":2,"archive_timestamp":"2026-08-04T23:11:58+00:00"},{"url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","archive_url":"http://web.archive.org/web/20260807053146/https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack","credibility":2,"archive_timestamp":"2026-08-07T05:31:46+00:00"},{"url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign","name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign - Chainguard","type":"research","archive_url":"http://web.archive.org/web/20260807005018/https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign","credibility":2,"archive_timestamp":"2026-08-07T00:50:18+00:00"},{"url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions","name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ - Tenable","type":"research","archive_url":"http://web.archive.org/web/20260704191810/https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions","credibility":2,"archive_timestamp":"2026-07-04T19:18:10+00:00"},{"url":"https://expel.com/blog/chaindrop-the-mini-shai-hulud-npm-worms-latest-wave-hits-keyv-and-cacheable/","name":"ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheable - Expel","type":"research","archive_url":"http://web.archive.org/web/20260806074200/https://expel.com/blog/chaindrop-the-mini-shai-hulud-npm-worms-latest-wave-hits-keyv-and-cacheable/","credibility":2,"archive_timestamp":"2026-08-06T07:42:00+00:00"},{"url":"https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html","name":"Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages - The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260804141927/https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html","credibility":2,"archive_timestamp":"2026-08-04T14:19:27+00:00"},{"url":"https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public","name":"Mini Shai-Hulud: The Worm Returns and Goes Public - Akamai","type":"research","archive_url":"http://web.archive.org/web/20260611232056/https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public","credibility":2,"archive_timestamp":"2026-06-11T23:20:56+00:00"},{"url":"https://www.infosecurity-magazine.com/news/chaindrop-worm-400-npm-two-billion/","name":"ChainDrop Worm Hits 400 npm Packages with Two Billion Monthly Installs - Infosecurity Magazine","type":"news_article","archive_url":"http://web.archive.org/web/20260805150604/https://www.infosecurity-magazine.com/news/chaindrop-worm-400-npm-two-billion/","credibility":2,"archive_timestamp":"2026-08-05T15:06:04+00:00"},{"url":"https://www.csoonline.com/article/4205276/chaindrop-credential-stealing-worm-infects-over-400-npm-packages.html","name":"ChainDrop credential stealing worm infects over 400 npm packages - CSO Online","type":"news_article","archive_url":"http://web.archive.org/web/20260805231945/https://www.csoonline.com/article/4205276/chaindrop-credential-stealing-worm-infects-over-400-npm-packages.html","credibility":2,"archive_timestamp":"2026-08-05T23:19:45+00:00"},{"url":"https://zerohunt.ai/blog/chaindrop-npm-worm-claude-code-hooks/","name":"ChainDrop: the npm worm that steals your AI assistant's credentials - Zero Hunt","type":"research","archive_url":"https://web.archive.org/web/20260807041414/https://zerohunt.ai/blog/chaindrop-npm-worm-claude-code-hooks/","credibility":2,"archive_timestamp":"2026-08-07T04:14:14+00:00"},{"url":"https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/","name":"TeamPCP / Mini Shai-Hulud npm Campaign: 600 Packages - Phoenix Security","type":"research","archive_url":"http://web.archive.org/web/20260728084628/https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/","credibility":2,"archive_timestamp":"2026-07-28T08:46:28+00:00"},{"url":"https://socradar.io/blog/dark-web-profile-teampcp/","name":"Dark Web Profile: TeamPCP - SOCRadar","type":"research","archive_url":"http://web.archive.org/web/20260907052912/https://socradar.io/blog/dark-web-profile-teampcp/","credibility":2,"archive_timestamp":"2026-09-07T05:29:12+00:00"},{"url":"https://cyberscoop.com/supply-chain-attack-malware-mini-shai-hulud-teampcp/","name":"Massive supply-chain attack compromises 440 packages in under four hours - CyberScoop","type":"news_article","archive_url":"http://web.archive.org/web/20260806092222/https://cyberscoop.com/supply-chain-attack-malware-mini-shai-hulud-teampcp/","credibility":2,"archive_timestamp":"2026-08-06T09:22:22+00:00"},{"url":"https://www.sourcetrail.com/javascript/npm/chaindrop-attack-over-435-npm-packages-compromised-in-supply-chain-worm/","name":"ChainDrop Attack: 435 npm Packages Compromised in Supply Chain Worm - Sourcetrail","type":"news_article","archive_url":"https://web.archive.org/web/20260807041316/https://www.sourcetrail.com/javascript/npm/chaindrop-attack-over-435-npm-packages-compromised-in-supply-chain-worm/","credibility":2,"archive_timestamp":"2026-08-07T04:13:16+00:00"},{"url":"https://cyberworldops.eu/en/chaindrop-the-npm-supply-chain-attack-that-compromised-1300-packages","name":"ChainDrop npm Attack Hits 1,300 Packages - CyberWorldOps","type":"news_article","archive_url":"https://web.archive.org/web/20260807003037/https://cyberworldops.eu/en/chaindrop-the-npm-supply-chain-attack-that-compromised-1300-packages","credibility":2,"archive_timestamp":"2026-08-07T00:30:37+00:00"},{"url":"https://www.kucoin.com/news/flash/shai-hulud-malware-infects-npm-pypi-packages-threatens-crypto-wallets","name":"Shai-Hulud Malware Infects NPM/PyPI Packages, Threatens Crypto Wallets - KuCoin","type":"news_article","archive_url":"https://web.archive.org/web/20260807041303/https://www.kucoin.com/news/flash/shai-hulud-malware-infects-npm-pypi-packages-threatens-crypto-wallets","credibility":2,"archive_timestamp":"2026-08-07T04:13:03+00:00"},{"url":"https://coinalertnews.com/news/2026/05/20/mini-shai-hulud-npm-attack","name":"Mini Shai-Hulud Attack Compromises 323 npm Packages in 30 Minutes - CoinAlertNews","type":"news_article","archive_url":"http://web.archive.org/web/20260807001436/https://coinalertnews.com/news/2026/05/20/mini-shai-hulud-npm-attack","credibility":3,"archive_timestamp":"2026-08-07T00:14:36+00:00"},{"url":"https://secarma.com/05-08-2026-chaindrop-npm-supply-chain-worm","name":"Microsoft details ChainDrop, a self-propagating worm hidden in over 400 npm packages - Secarma","type":"news_article","archive_url":"https://web.archive.org/web/20260807121207/https://secarma.com/05-08-2026-chaindrop-npm-supply-chain-worm","credibility":2,"archive_timestamp":"2026-08-07T12:12:07+00:00"},{"url":"https://cybersecuritynews.com/600-npm-packages-compromised/","name":"600+ npm Packages Compromised in New Mini Shai-Hulud Supply Chain Attack - CybersecurityNews","type":"news_article","archive_url":"http://web.archive.org/web/20260921115825/https://cybersecuritynews.com/600-npm-packages-compromised/","credibility":2,"archive_timestamp":"2026-09-21T11:58:25+00:00"},{"url":"https://thenextweb.com/news/chaindrop-npm-worm-shai-hulud-provenance-ai-tools","name":"ChainDrop: the npm worm that faked being legitimate - The Next Web","type":"news_article","archive_url":"http://web.archive.org/web/20260805121714/https://thenextweb.com/news/chaindrop-npm-worm-shai-hulud-provenance-ai-tools","credibility":2,"archive_timestamp":"2026-08-05T12:17:14+00:00"},{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages - StepSecurity","type":"research","archive_url":"http://web.archive.org/web/20260915050323/https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","credibility":2,"archive_timestamp":"2026-09-15T05:03:23+00:00"},{"url":"https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","name":"ChainDrop: Inside a Self-Propagating npm Worm - Palo Alto Networks Unit 42","type":"research","archive_url":"http://web.archive.org/web/20260807075134/https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/","credibility":2,"archive_timestamp":"2026-08-07T07:51:34+00:00"},{"url":"https://www.techradar.com/pro/security/new-chaindrop-worm-poisons-over-1-300-npm-packages-keyv-and-cacheable-among-those-hit","name":"New ChainDrop worm poisons over 1,300 npm packages - TechRadar","type":"news_article","archive_url":"http://web.archive.org/web/20260806035313/https://www.techradar.com/pro/security/new-chaindrop-worm-poisons-over-1-300-npm-packages-keyv-and-cacheable-among-those-hit","credibility":2,"archive_timestamp":"2026-08-06T03:53:13+00:00"},{"url":"https://www.sygnia.co/threat-reports-and-advisories/shai-hulud-returns-software-supply-chain-attack-npm-keyv/","name":"Shai-Hulud Returns: When Software Trust Becomes the Attack Surface - Sygnia","type":"research","archive_url":"https://web.archive.org/web/20260807185745/https://www.sygnia.co/threat-reports-and-advisories/shai-hulud-returns-software-supply-chain-attack-npm-keyv/","credibility":2,"archive_timestamp":"2026-08-07T18:57:45+00:00"},{"url":"https://semgrep.dev/blog/2026/its-not-npm-ver-yet-npm-worm-chaindrop-hits-400-packages-including-jaredwray-servicetitan-ornikar-qlik-and-nebulajs/","name":"It's not npm-ver yet: NPM worm Chaindrop hits 400+ packages - Semgrep","type":"research","archive_url":"https://web.archive.org/web/20260807154410/https://semgrep.dev/blog/2026/its-not-npm-ver-yet-npm-worm-chaindrop-hits-400-packages-including-jaredwray-servicetitan-ornikar-qlik-and-nebulajs/","credibility":2,"archive_timestamp":"2026-08-07T15:44:10+00:00"},{"url":"https://www.ox.security/blog/a-new-infostealer-worm-hits-npm-affecting-keyv-and-cacheable/","name":"A Massive Shai-Hulud Campaign Hits npm: +440 Packages Compromised - OX Security","type":"research","archive_url":"http://web.archive.org/web/20260805214527/https://www.ox.security/blog/a-new-infostealer-worm-hits-npm-affecting-keyv-and-cacheable/","credibility":2,"archive_timestamp":"2026-08-05T21:45:27+00:00"},{"url":"https://www.itpro.com/security/malware/shai-hulud-here-we-go-again-thousands-of-npm-packages-compromised-in-chaindrop-malware-campaign-where-hackers-taunt-victims","name":"'Shai-Hulud: Here We Go Again': Thousands of npm packages compromised - IT Pro","type":"news_article","archive_url":"http://web.archive.org/web/20260806134158/https://www.itpro.com/security/malware/shai-hulud-here-we-go-again-thousands-of-npm-packages-compromised-in-chaindrop-malware-campaign-where-hackers-taunt-victims","credibility":2,"archive_timestamp":"2026-08-06T13:41:58+00:00"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","name":"Shai-Hulud 2.0: Guidance for detecting, investigating, and defending - Microsoft Security Blog","type":"research","archive_url":"http://web.archive.org/web/20260713164047/https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/","credibility":1,"archive_timestamp":"2026-07-13T16:40:47+00:00"},{"url":"https://www.reversinglabs.com/blog/shai-hulud-worm-npm","name":"Shai-Hulud npm supply chain attack: What you need to know - ReversingLabs","type":"research","archive_url":"http://web.archive.org/web/20260801132340/https://www.reversinglabs.com/blog/shai-hulud-worm-npm","credibility":2,"archive_timestamp":"2026-08-01T13:23:40+00:00"},{"url":"https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/","name":"Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised - SafeDep","type":"research","archive_url":"http://web.archive.org/web/20260731152550/https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/","credibility":2,"archive_timestamp":"2026-07-31T15:25:50+00:00"},{"url":"https://www.theregister.com/cyber-crime/2026/05/18/shai-hulud-copycat-hits-another-npm-package/5242180","name":"Shai-Hulud copycat worm infects yet another npm package - The Register","type":"news_article","archive_url":"http://web.archive.org/web/20260805070024/https://www.theregister.com/cyber-crime/2026/05/18/shai-hulud-copycat-hits-another-npm-package/5242180","credibility":2,"archive_timestamp":"2026-08-05T07:00:24+00:00"},{"url":"https://www.theregister.com/security/2026/06/01/shai-hulud-malware-infects-red-hat-npm-packages-downloaded-80k-times-weekly/5249803","name":"Shai-Hulud malware worms Red Hat npm packages - The Register","type":"news_article","archive_url":"http://web.archive.org/web/20260726085001/https://www.theregister.com/security/2026/06/01/shai-hulud-malware-infects-red-hat-npm-packages-downloaded-80k-times-weekly/5249803","credibility":2,"archive_timestamp":"2026-07-26T08:50:01+00:00"},{"url":"https://insights.integrity360.com/threat-advisories/chaindrop-the-keyv-and-cacheable-npm-supply-chain-attack","name":"ChainDrop: The Keyv and Cacheable npm Supply Chain Attack - Integrity360","type":"research","archive_url":"https://web.archive.org/web/20260808014915/https://insights.integrity360.com/threat-advisories/chaindrop-the-keyv-and-cacheable-npm-supply-chain-attack","credibility":2,"archive_timestamp":"2026-08-08T01:49:15+00:00"},{"url":"https://mallory.ai/stories/019fcc7f-9d0e-744a-8393-d8c22cca90e4","name":"ChainDrop npm Worm Compromises Packages via Preinstall Credential Harvester - Mallory","type":"research","archive_url":"https://web.archive.org/web/20260807121743/https://mallory.ai/stories/019fcc7f-9d0e-744a-8393-d8c22cca90e4","credibility":2,"archive_timestamp":"2026-08-07T12:17:43+00:00"},{"url":"https://cyberpress.org/shai-hulud-npm-worm-returns/","name":"Shai-Hulud Returns With Self-Propagating npm Worm - CyberPress","type":"news_article","archive_url":"https://web.archive.org/web/20261002055023/https://cyberpress.org/shai-hulud-npm-worm-returns/","credibility":3,"archive_timestamp":"2026-10-02T05:50:23+00:00"},{"url":"https://undercodetesting.com/chaindrop-the-npm-worm-that-turned-127-million-weekly-downloads-into-a-credential-stealing-botnet-video/","name":"CHAINDROP: npm Worm Turned 127M Weekly Downloads Into Credential-Stealing Botnet - UnderCode Testing","type":"news_article","archive_url":"https://web.archive.org/web/20260808040715/https://undercodetesting.com/chaindrop-the-npm-worm-that-turned-127-million-weekly-downloads-into-a-credential-stealing-botnet-video/","credibility":3,"archive_timestamp":"2026-08-08T04:07:15+00:00"},{"url":"https://www.techtimes.com/articles/323089/20260805/keyv-npm-supply-chain-attack-hides-malware-ai-agent-files-scanners-never-read.htm","name":"keyv npm Supply Chain Attack Hides Malware in AI Agent Files Scanners Never Read - TechTimes","type":"news_article","archive_url":"https://web.archive.org/web/20261002105011/https://www.techtimes.com/articles/323089/20260805/keyv-npm-supply-chain-attack-hides-malware-ai-agent-files-scanners-never-read.htm","credibility":3,"archive_timestamp":"2026-10-02T10:50:11+00:00"},{"url":"https://rodtrent.substack.com/p/security-check-in-quick-hits-cisa","name":"Security Check-in: CISA Flags ChainDrop npm Worm - Rod Trent Substack","type":"news_article","archive_url":"http://web.archive.org/web/20260806055120/https://rodtrent.substack.com/p/security-check-in-quick-hits-cisa","credibility":3,"archive_timestamp":"2026-08-06T05:51:20+00:00"},{"url":"https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack","name":"Keyv and friends compromised in npm supply chain attack - Aikido Security","type":"research","archive_url":"http://web.archive.org/web/20260807082320/https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack","credibility":2,"archive_timestamp":"2026-08-07T08:23:20+00:00"},{"url":"https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","name":"Worm compromises hundreds of popular npm packages - Datadog Security Labs","type":"research","archive_url":"http://web.archive.org/web/20260808213738/https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/","credibility":2,"archive_timestamp":"2026-08-08T21:37:38+00:00"},{"url":"https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain","name":"Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack - Socket","type":"research","archive_url":"http://web.archive.org/web/20260806112646/https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain","credibility":2,"archive_timestamp":"2026-08-06T11:26:46+00:00"},{"url":"https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/","name":"Compromised keyv Maintainer Account Triggers Massive npm Supply Chain Attack - Orca Security","type":"research","archive_url":"http://web.archive.org/web/20260808213733/https://orca.security/resources/blog/compromised-keyv-npm-supply-chain-attack/","credibility":2,"archive_timestamp":"2026-08-08T21:37:33+00:00"},{"url":"https://safedep.io/keyv-npm-supply-chain-compromise/","name":"keyv and cacheable npm compromise: 400+ packages - SafeDep","type":"research","archive_url":"http://web.archive.org/web/20260804104025/https://safedep.io/keyv-npm-supply-chain-compromise/","credibility":2,"archive_timestamp":"2026-08-04T10:40:25+00:00"},{"url":"https://cloudsmith.com/blog/keyv-and-cacheable-npm-packages-compromised-in-active-supply-chain-attack","name":"Keyv and Cacheable npm Packages Compromised in Active Supply-Chain Attack - Cloudsmith","type":"research","archive_url":"http://web.archive.org/web/20260809055720/https://cloudsmith.com/blog/keyv-and-cacheable-npm-packages-compromised-in-active-supply-chain-attack","credibility":2,"archive_timestamp":"2026-08-09T05:57:20+00:00"},{"url":"https://strobes.co/blog/keyv-cacheable-npm-supply-chain-attack/","name":"keyv and cacheable npm Supply Chain Attack: What to Do - Strobes","type":"research","archive_url":"http://web.archive.org/web/20260804204322/https://strobes.co/blog/keyv-cacheable-npm-supply-chain-attack/","credibility":2,"archive_timestamp":"2026-08-04T20:43:22+00:00"},{"url":"https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html","name":"Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks - The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260807134722/https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html","credibility":2,"archive_timestamp":"2026-08-07T13:47:22+00:00"},{"url":"https://cybersecuritynews.com/keyv-npm-package-compromised/","name":"Keyv npm Package with 127M Weekly Downloads Compromised in Shai-Hulud Attack - CybersecurityNews","type":"news_article","archive_url":"http://web.archive.org/web/20260806224653/https://cybersecuritynews.com/keyv-npm-package-compromised/","credibility":2,"archive_timestamp":"2026-08-06T22:46:53+00:00"},{"url":"https://teampcp.pluto.security/","name":"TeamPCP - The supply chain attack story so far - Pluto Security","type":"research","archive_url":"http://web.archive.org/web/20260809115222/https://teampcp.pluto.security/","credibility":2,"archive_timestamp":"2026-08-09T11:52:22+00:00"},{"url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/","name":"Weaponizing the Protectors: TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure - Palo Alto Unit 42","type":"research","archive_url":"http://web.archive.org/web/20260804125712/https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/","credibility":2,"archive_timestamp":"2026-08-04T12:57:12+00:00"},{"url":"https://snyk.io/blog/tanstack-npm-packages-compromised/","name":"TanStack npm Packages Hit by Mini Shai-Hulud - Snyk","type":"research","archive_url":"http://web.archive.org/web/20260804231200/https://snyk.io/blog/tanstack-npm-packages-compromised/","credibility":2,"archive_timestamp":"2026-08-04T23:12:00+00:00"},{"url":"https://www.endorlabs.com/learn/npm-malware-compromises-keyv-and-cacheable-with-500m-weekly-downloads-and-spreads-to-hundreds-of-packages","name":"NPM Malware Compromises keyv and cacheable - Endor Labs","type":"research","archive_url":"http://web.archive.org/web/20260804230825/https://www.endorlabs.com/learn/npm-malware-compromises-keyv-and-cacheable-with-500m-weekly-downloads-and-spreads-to-hundreds-of-packages","credibility":2,"archive_timestamp":"2026-08-04T23:08:25+00:00"},{"url":"https://cycode.com/blog/keyv-cacheable-npm-worm-ai-coding-agents/","name":"No Install Required: The keyv and cacheable npm Worm That Weaponized AI Coding Agents - Cycode","type":"research","archive_url":"http://web.archive.org/web/20260808160901/https://cycode.com/blog/keyv-cacheable-npm-worm-ai-coding-agents/","credibility":2,"archive_timestamp":"2026-08-08T16:09:01+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-08-06T23:42:00.143354+00:00","updated_at":"2026-10-27T19:18:30.131+00:00"},"source_quality":{"total":60,"tier1":0,"tier2":0,"tier3":0,"unrated":60},"follower_count":null,"content_updated_at":"2026-10-27T19:18:30.807Z","last_fact_checked_at":"2026-10-27T19:18:30.497Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}