Audit log

Every state-changing event for ChainDrop / Mini Shai-Hulud npm Supply Chain Worm (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-06 23:42:14Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   99w2fB6zyqQq…W8o8j7hNcopysha256 → base58

   verifying row…

   canonical bytes (38193 B) ▸

   {"actor":"system:backfill","investigation_id":"9b3e7fc9-d98c-4d79-8b5d-852d1bd6f02b","kind":"publish","page_slug":"chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026","published_at":"2026-08-06T23:42:13.895Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ChainDrop / Mini Shai-Hulud npm Supply Chain Worm (August 2026)","sections":[{"content":"ChainDrop is the latest variant in the Shai-Hulud supply chain worm family, a series of self-propagating npm attacks attributed to the threat group TeamPCP (also tracked by Google's Threat Intelligence Group as UNC6780, with additional aliases including DeadCatx3, PCPcat, ShellForce, and CipherForce). The campaign name derives from the worm's novel use of the Ethereum blockchain for command-and-control (C2) infrastructure, a technique known as EtherHiding. Prior Shai-Hulud generations include the original worm (September 2025), SHA1-Hulud (November 2025), SANDWORM_MODE (March 2026), and Mini Shai-Hulud (April 2026 onward). ChainDrop is assessed as the Mini Shai-Hulud fourth-generation variant's most impactful wave to date. TeamPCP is assessed as a financially motivated cybercriminal group; a spokesperson using the handle T00001B described the group as 'a loose-knit group of teenagers and young adults' in a Forbes interview, though researchers note hybrid motivations including credential theft, access brokering, and selective destructive activity with geopolitical undertones.","heading":"Overview and Classification","severity":"critical","sources":[{"credibility":2,"name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"credibility":2,"name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ - Tenable","type":"research","url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"credibility":1,"name":"ChainDrop supply chain compromise: Anatomy of a self-propagating worm - Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/"},{"credibility":2,"name":"Dark Web Profile: TeamPCP - SOCRadar","type":"research","url":"https://socradar.io/blog/dark-web-profile-teampcp/"}]},{"content":"The August 4, 2026 attack originated with the compromise of the GitHub account of Jared Wray (handle: jaredwray), the maintainer of the keyv key-value storage library and the cacheable caching framework. Wray subsequently confirmed via X that he employed OpenID Connect (OIDC) with npm and one-time codes for GitHub, meaning no long-lived static token was in use; the precise method of account compromise has not been publicly confirmed at time of publication. At 09:02:37 UTC, attackers pushed a poisoned commit (hash ee2681a) directly to the jaredwray/keyv monorepo's main branch, injecting two malicious files: a 29,918-byte obfuscated dropper (setup.mjs) and a 727,680-byte second-stage worm payload (Math_Symbol.js). Repository hooks were simultaneously planted in .claude/settings.json and .vscode/tasks.json. A cover test was deleted at 09:23:50 UTC to reduce detection surface. The projects' own GitHub Actions release workflows then built and attested the malicious artifacts, producing cryptographically valid SLSA Build Level 3 provenance signatures indistinguishable from legitimate releases, thereby defeating automated provenance-based supply chain gates.","heading":"Initial Compromise Vector","severity":"critical","sources":[{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"},{"credibility":2,"name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign - Chainguard","type":"research","url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign"},{"credibility":2,"name":"Massive ChainDrop npm supply-chain attack infects hundreds of packages - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/"}]},{"content":"The infection chain operates in two stages. Stage 1 (setup.mjs, 29,918 bytes) executes automatically via the preinstall lifecycle hook in package.json, requiring no user interaction beyond running npm install. Rather than shipping platform-specific binaries, it downloads the official Bun JavaScript runtime (v1.3.13) from legitimate GitHub release infrastructure, using genuine GitHub URLs to evade network-based detection. Stage 2 (Math_Symbol.js, approximately 710-727 KB) is a heavily obfuscated worm employing control-flow flattening, Base91 encoding, and a custom position-dependent substitution cipher (PBKDF2-HMAC-SHA256) for string obfuscation. The SHA-256 hash of the Stage 2 payload is 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc; Stage 1 hash is 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668. The malware is cross-platform, targeting Linux, macOS, and Windows environments. Process isolation is achieved via a PID lock file at /tmp/tmp.dpkg_14527.lock and a _NODE_RUNTIME_INIT=1 environment flag to prevent re-execution. Empty signal handlers swallow exceptions to prevent crash-based detection.","heading":"Technical Payload and Execution Chain","severity":"critical","sources":[{"credibility":2,"name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"}]},{"content":"The Stage 2 payload is an aggressive credential harvester that reads GitHub Actions runner process memory via /proc/pid/mem to extract temporary OIDC tokens and publishing credentials. It systematically targets over 100 credential file paths across cloud providers (AWS, Azure, GCP, Alibaba, Tencent, Hetzner), infrastructure tooling (Kubernetes configs, HashiCorp Vault KV mounts across 17 regions, SSH private keys), and source control (GitHub PATs, npm tokens with bypass_2fa). Of particular relevance to crypto and Web3 developers, the payload explicitly targets local cryptocurrency keystores including Foundry wallet files, Solana CLI keypairs, and Monero wallet configurations. AI coding tool credentials are also harvested: Claude Code (Anthropic API keys), OpenAI, Cursor, and Gemini configuration files are all targeted. Browser credential stores and local password vaults (1Password, Bitwarden) are enumerated. Stolen credentials are JSON-serialized, gzip-compressed, and AES-256-GCM encrypted before exfiltration; RSA public key wrapping is applied to the symmetric key. Exfiltration channels include direct HTTPS POST to C2 domains and attacker-created public GitHub repositories using Dune-themed names (sardaukar, fremen, atreides, sandworm, melange) with a default description of 'Shai-Hulud: Here We Go Again.' A persistence component called gh-token-monitor installs a watcher that fires when a stolen GitHub token is revoked, providing attackers an alert to re-establish access; responders must remove this monitor before revoking tokens.","heading":"Credential Harvesting and Crypto/Web3 Targeting","severity":"critical","sources":[{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":3,"name":"Mini Shai-Hulud Attack Compromises 323 npm Packages in 30 Minutes, Threatening Blockchain Developer Credentials - CoinAlertNews","type":"news_article","url":"https://coinalertnews.com/news/2026/05/20/mini-shai-hulud-npm-attack"},{"credibility":2,"name":"Shai-Hulud Malware Infects NPM/PyPI Packages, Threatens Crypto Wallets - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/shai-hulud-malware-infects-npm-pypi-packages-threatens-crypto-wallets"}]},{"content":"ChainDrop's most notable technical innovation is its use of the Ethereum mainnet for C2 domain resolution, a technique known as EtherHiding. The payload queries an Ethereum smart contract at address 0xE1f2395ee43e45A1556EC6438a88c31B83493103 using function selector 0x53ed5143 (a StringListStore contract), cycling through up to 75 public RPC provider endpoints in sequence. The smart contract's return value is the active exfiltration domain; at time of analysis by Elastic Security Labs, the live contract returned npm-cache[.]com. This architecture enables the threat actor to rotate C2 infrastructure by updating on-chain state without modifying or republishing the worm payload itself, rendering traditional domain-sinkhole operations ineffective. If blockchain resolution fails, the worm falls back to searching GitHub commit history for a cryptographically signed marker string (thebeautifulmarchoftime or thebeautifulsnadsoftime), accepting a C2 domain only after validating it against an embedded RSA-4096 public key. This dual-layer resilience makes the C2 infrastructure resistant to both network-level blocking and coordinated takedown efforts.","heading":"Ethereum Blockchain Command-and-Control Infrastructure","severity":"critical","sources":[{"credibility":2,"name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain"},{"credibility":2,"name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"}]},{"content":"ChainDrop's self-propagating capability distinguishes it from conventional supply chain compromises. When the payload harvests npm tokens possessing the bypass_2fa flag alongside package write permissions, the worm automatically downloads the current clean tarball for every package those credentials can publish, injects the malicious Stage 1 and Stage 2 files, increments the patch version, and republishes the infected package to the npm registry. This automated propagation cycle required no further attacker interaction after the initial keyv compromise. Within four hours of the first malicious commit at 09:02 UTC on August 4, the worm had poisoned 444 packages and 2,212 versions across more than 14 victim organizations. The second propagation wave affected namespaces including @servicetitan (141 packages), @onereach (78), @or-sdk (74), and @ornikar (42), among others. Confirmed affected organizations include Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. Total ecosystem exposure across all compromised packages is estimated at approximately 2 billion combined monthly downloads. Some tallies in subsequent reporting cite over 1,300 total compromised package versions as cleanup operations revealed additional propagation paths.","heading":"Self-Propagation Mechanism and Scale","severity":"critical","sources":[{"credibility":2,"name":"ChainDrop Attack: 435 npm Packages Compromised in Supply Chain Worm - Sourcetrail","type":"news_article","url":"https://www.sourcetrail.com/javascript/npm/chaindrop-attack-over-435-npm-packages-compromised-in-supply-chain-worm/"},{"credibility":1,"name":"Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack - SecurityWeek","type":"news_article","url":"https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/"},{"credibility":2,"name":"ChainDrop npm Attack Hits 1,300 Packages - CyberWorldOps","type":"news_article","url":"https://cyberworldops.eu/en/chaindrop-the-npm-supply-chain-attack-that-compromised-1300-packages"},{"credibility":2,"name":"ChainDrop Worm Hits 400 npm Packages with Two Billion Monthly Installs - Infosecurity Magazine","type":"news_article","url":"https://www.infosecurity-magazine.com/news/chaindrop-worm-400-npm-two-billion/"}]},{"content":"A notable evolution in ChainDrop relative to prior Shai-Hulud variants is the deliberate planting of persistence hooks inside developer integrated development environments and AI coding agents. Malicious configurations are written to .claude/settings.json (targeting Claude Code sessions), .vscode/tasks.json, and corresponding .mjs loader files. These hooks execute the worm payload whenever a developer opens an infected repository in VS Code or initiates a Claude Code session, independent of any npm install event. This means that credential theft can persist and recur even after an organization removes the malicious package versions from its lock files, as long as the infected repository files remain on disk. Researchers at ZeroHunt noted that the hooks are specifically timed to align with developer workflows, maximizing the window during which CI/CD runner memory can be scraped for active OIDC tokens. The Snyk advisory classified this behavior under CWE-506 (embedded malicious code) with a critical severity rating.","heading":"IDE and AI Agent Persistence","severity":"critical","sources":[{"credibility":2,"name":"ChainDrop: the npm worm that steals your AI assistant's credentials - Zero Hunt","type":"research","url":"https://zerohunt.ai/blog/chaindrop-npm-worm-claude-code-hooks/"},{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"}]},{"content":"Eleven initial malicious releases were identified across eight package names as the worm carriers published between 09:35 and 10:28 UTC on August 4, 2026. The core affected packages and their approximate weekly download volumes at time of compromise are: keyv@6.0.0 (153.7 million weekly downloads, the initial vector), flat-cache@6.1.24 (149.9 million), file-entry-cache@11.1.6 (147.6 million), cacheable-request@13.0.20 (34 million), cache-manager@7.2.10 (4.3 million), @cacheable/net@2.1.1, @cacheable/node-cache@3.1.2, @cacheable/memory@2.2.1, @cacheable/utils@2.5.1, cacheable@2.5.1, and ecto@5.0.1. All of these were published through the legitimate GitHub Actions trusted publishing workflow using the compromised maintainer's OIDC credentials, producing valid SLSA provenance attestations. Because keyv functions as a transitive dependency for many tools, the blast radius extended significantly beyond direct dependents.","heading":"Primary Affected Packages","severity":"critical","sources":[{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"credibility":2,"name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"credibility":2,"name":"ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheable - Expel","type":"research","url":"https://expel.com/blog/chaindrop-the-mini-shai-hulud-npm-worms-latest-wave-hits-keyv-and-cacheable/"}]},{"content":"ChainDrop demonstrated that SLSA Build Level 3 provenance attestation, widely promoted as a supply chain integrity guarantee, does not protect against repository-level compromises. Because the malicious source code was committed to the repository before the build workflow ran, the resulting npm package received a cryptographically valid provenance attestation generated by GitHub Actions' OIDC trusted publisher. The attestation accurately reflects that the package was built from the published source by the expected workflow; it cannot detect that the source itself was modified. This represents a fundamental boundary in the provenance model. Additional evasion techniques include: payload minimalism (only three files added per package, with all compiled artifacts remaining byte-identical to clean versions); the Bun runtime download disguised as routine GitHub release traffic; a position-dependent substitution cipher (PBKDF2-HMAC-SHA256) for string obfuscation; gzip and AES-256-GCM encryption for payload contents; and process detachment flags that prevent detection via standard process monitoring.","heading":"SLSA Provenance Bypass and Evasion Techniques","severity":"high","sources":[{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"credibility":2,"name":"ChainDrop: the npm worm that faked being legitimate - The Next Web","type":"news_article","url":"https://thenextweb.com/news/chaindrop-npm-worm-shai-hulud-provenance-ai-tools"},{"credibility":2,"name":"TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages - StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"}]},{"content":"The Cyber Security Agency of Singapore (CSA) issued Advisory AD-2026-009 on the ongoing npm supply chain attack affecting keyv and related packages, referencing the Shai-Hulud worm. The UK's NHS England Digital issued Cyber Alert CC-4781 addressing the supply chain attack affecting npm and PyPI packages. CISA was flagged alongside the ChainDrop event in security roundups, though no dedicated CISA advisory specific to ChainDrop has been confirmed in available sources. The npm registry began unpublishing affected versions at approximately 10:39 UTC on August 4, with cleanup substantially complete by 18:10 UTC. Snyk assigned advisory identifier SNYK-JS-KEYV-18515941 (CWE-506); no CVE identifier had been assigned at time of publication for the ChainDrop wave specifically, though CVE-2026-45321 (CVSS 9.6) was previously assigned to the TanStack compromise wave of Mini Shai-Hulud in May 2026. Microsoft's Security Research team (credited: Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan) published primary technical analysis on August 4, 2026.","heading":"Advisory and Regulatory Response","severity":"high","sources":[{"credibility":1,"name":"Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages (Shai-Hulud Worm) - Cyber Security Agency of Singapore","type":"regulatory","url":"https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/"},{"credibility":1,"name":"Supply Chain Attack Affecting Numerous npm and PyPI Packages - NHS England Digital","type":"regulatory","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4781"},{"credibility":1,"name":"ChainDrop supply chain compromise: Anatomy of a self-propagating worm - Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/"},{"credibility":2,"name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ - Tenable","type":"research","url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"}]},{"content":"Known indicators of compromise (IOCs) for the ChainDrop wave include the following. Malicious file names: setup.mjs and Math_Symbol.js (initial wave); math_init.js (second wave). File hashes: setup.mjs SHA-256 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668; Math_Symbol.js / math_init.js SHA-256 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc. Ethereum smart contract: 0xE1f2395ee43e45A1556EC6438a88c31B83493103 (function selector 0x53ed5143). Active C2 domain at time of analysis: npm-cache[.]com. GitHub commit markers: thebeautifulmarchoftime and thebeautifulsnadsoftime. GitHub repository description string used for exfiltration repos: 'Shai-Hulud: Here We Go Again.' Exfiltration repository name patterns: Dune-themed vocabulary (sardaukar, fremen, atreides, sandworm, melange). Lock file: /tmp/tmp.dpkg_14527.lock. Persistence paths: .claude/settings.json, .claude/setup.mjs, .claude/math_init.js, .vscode/tasks.json, .vscode/setup.mjs. Worm-authored commits use the author name 'claude' with message 'chore: update config.' Bun runtime download from github.com/oven-sh/bun/releases during npm install is anomalous and indicative of infection.","heading":"Indicators of Compromise","severity":"high","sources":[{"credibility":2,"name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"}]},{"content":"Organizations that may have installed affected package versions should treat any system on which an infected package was installed as fully compromised. Recommended remediation steps drawn from multiple security advisories: (1) Scan package-lock.json, yarn.lock, and pnpm-lock.yaml for any affected package versions listed in the IOC tables published by Wiz, JFrog, and Snyk. (2) Remove the gh-token-monitor persistence component before revoking any GitHub tokens, as the dead-man's switch will alert the attacker to revocation and may trigger further malicious actions. (3) Rotate all credentials that existed in compromised environments, with highest priority on npm tokens with bypass_2fa and write permissions, GitHub PATs and OAuth tokens, GitHub Actions OIDC configurations, AWS keys, Azure and GCP service account credentials, Kubernetes service account tokens, HashiCorp Vault tokens, SSH private keys, and any cryptocurrency wallet private keys or seed phrases stored on disk. (4) Audit all repository branches for the five hook files: .vscode/tasks.json, .vscode/setup.mjs, .claude/math_init.js, .claude/settings.json, .claude/setup.mjs. (5) Search GitHub audit logs for the commit message 'chore: update config' and branch name dependabot/github_actions/format/setup-formatter. (6) Rebuild CI/CD runners from clean images; do not rely on credential rotation alone if runner environments cannot be verified clean. (7) Review npm trusted publishers and GitHub OIDC configurations. JFrog customers using Curation immaturity policies received automatic protection within 24 hours of the attack.","heading":"Remediation Guidance","severity":"high","sources":[{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"},{"credibility":2,"name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"}]},{"content":"ChainDrop is the most impactful wave of the Shai-Hulud campaign series, which began in September 2025. The prior generation, Mini Shai-Hulud, had several notable incidents before the August 2026 ChainDrop wave. On May 11, 2026, TeamPCP compromised the GitHub Actions CI pipeline of TanStack and published 84 malicious package versions across 42 @tanstack/* packages in approximately six minutes; this incident was assigned CVE-2026-45321 (CVSS 9.6). On May 19, 2026, the @antv npm ecosystem (Alibaba's data visualization stack) was struck, with 639 malicious versions across 323 packages published in under 30 minutes; Socket's threat research team detected most within 6.7 minutes. On May 12, 2026, TeamPCP open-sourced the Shai-Hulud worm on GitHub under an MIT License with the message 'Shai-Hulud: Open Sourcing The Carnage,' simultaneously announcing a $1,000 contest for the largest supply chain attack using the code, significantly lowering the barrier for copycat attacks. Google's Threat Intelligence Group tracks TeamPCP as UNC6780. Confirmed victims across all Mini Shai-Hulud waves include OpenAI, Mistral AI, the European Commission, and GitHub, among others. The campaign has alleged targets across both npm and PyPI ecosystems, with over 2,500 compromised GitHub repositories reported at peak scale.","heading":"Prior Campaign History (Shai-Hulud / TeamPCP)","severity":"high","sources":[{"credibility":2,"name":"Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages - The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html"},{"credibility":2,"name":"Mini Shai-Hulud: The Worm Returns and Goes Public - Akamai","type":"research","url":"https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public"},{"credibility":2,"name":"TeamPCP / Mini Shai-Hulud npm Campaign: 600 Packages, Confirmed Active Payload - Phoenix Security","type":"research","url":"https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/"},{"credibility":2,"name":"600+ npm Packages Compromised in New Mini Shai-Hulud Supply Chain Attack - CybersecurityNews","type":"news_article","url":"https://cybersecuritynews.com/600-npm-packages-compromised/"},{"credibility":2,"name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ - Tenable","type":"research","url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"}]}],"sources_used":[{"credibility":1,"name":"ChainDrop supply chain compromise: Anatomy of a self-propagating worm - Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/"},{"credibility":1,"name":"Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages (Shai-Hulud Worm) - Cyber Security Agency of Singapore","type":"regulatory","url":"https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/"},{"credibility":1,"name":"Supply Chain Attack Affecting Numerous npm and PyPI Packages - NHS England Digital","type":"regulatory","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4781"},{"credibility":1,"name":"Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack - SecurityWeek","type":"news_article","url":"https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/"},{"credibility":2,"name":"Massive ChainDrop npm supply-chain attack infects hundreds of packages - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/"},{"credibility":2,"name":"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity","type":"research","url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"credibility":2,"name":"Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs","type":"research","url":"https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain"},{"credibility":2,"name":"Major Shai-Hulud campaign strikes npm again, affecting keyv and 400+ packages - JFrog Security Research","type":"research","url":"https://research.jfrog.com/post/shai-hulud-is-back-august/"},{"credibility":2,"name":"Inside the keyv npm Supply Chain Compromise - Snyk","type":"research","url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"credibility":2,"name":"keyv and cacheable npm Package Hijacked in Supply Chain Attack - Wiz Blog","type":"research","url":"https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack"},{"credibility":2,"name":"The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign - Chainguard","type":"research","url":"https://www.chainguard.dev/unchained/the-keyv-and-cacheable-npm-supply-chain-attack-inside-the-mini-shai-hulud-campaign"},{"credibility":2,"name":"Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ - Tenable","type":"research","url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"credibility":2,"name":"ChainDrop: The Mini Shai Hulud npm worm's latest wave hits keyv and cacheable - Expel","type":"research","url":"https://expel.com/blog/chaindrop-the-mini-shai-hulud-npm-worms-latest-wave-hits-keyv-and-cacheable/"},{"credibility":2,"name":"Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages - The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html"},{"credibility":2,"name":"Mini Shai-Hulud: The Worm Returns and Goes Public - Akamai","type":"research","url":"https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public"},{"credibility":2,"name":"ChainDrop Worm Hits 400 npm Packages with Two Billion Monthly Installs - Infosecurity Magazine","type":"news_article","url":"https://www.infosecurity-magazine.com/news/chaindrop-worm-400-npm-two-billion/"},{"credibility":2,"name":"ChainDrop credential stealing worm infects over 400 npm packages - CSO Online","type":"news_article","url":"https://www.csoonline.com/article/4205276/chaindrop-credential-stealing-worm-infects-over-400-npm-packages.html"},{"credibility":2,"name":"ChainDrop: the npm worm that steals your AI assistant's credentials - Zero Hunt","type":"research","url":"https://zerohunt.ai/blog/chaindrop-npm-worm-claude-code-hooks/"},{"credibility":2,"name":"TeamPCP / Mini Shai-Hulud npm Campaign: 600 Packages - Phoenix Security","type":"research","url":"https://phoenix.security/teampcp-mini-shai-hulud-npm-atool-maintainer-compromise-2026/"},{"credibility":2,"name":"Dark Web Profile: TeamPCP - SOCRadar","type":"research","url":"https://socradar.io/blog/dark-web-profile-teampcp/"},{"credibility":2,"name":"Massive supply-chain attack compromises 440 packages in under four hours - CyberScoop","type":"news_article","url":"https://cyberscoop.com/supply-chain-attack-malware-mini-shai-hulud-teampcp/"},{"credibility":2,"name":"ChainDrop Attack: 435 npm Packages Compromised in Supply Chain Worm - Sourcetrail","type":"news_article","url":"https://www.sourcetrail.com/javascript/npm/chaindrop-attack-over-435-npm-packages-compromised-in-supply-chain-worm/"},{"credibility":2,"name":"ChainDrop npm Attack Hits 1,300 Packages - CyberWorldOps","type":"news_article","url":"https://cyberworldops.eu/en/chaindrop-the-npm-supply-chain-attack-that-compromised-1300-packages"},{"credibility":2,"name":"Shai-Hulud Malware Infects NPM/PyPI Packages, Threatens Crypto Wallets - KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/shai-hulud-malware-infects-npm-pypi-packages-threatens-crypto-wallets"},{"credibility":3,"name":"Mini Shai-Hulud Attack Compromises 323 npm Packages in 30 Minutes - CoinAlertNews","type":"news_article","url":"https://coinalertnews.com/news/2026/05/20/mini-shai-hulud-npm-attack"},{"credibility":2,"name":"Microsoft details ChainDrop, a self-propagating worm hidden in over 400 npm packages - Secarma","type":"news_article","url":"https://secarma.com/05-08-2026-chaindrop-npm-supply-chain-worm"}],"summary":"ChainDrop is a self-propagating npm supply chain worm discovered on August 4, 2026, representing the latest wave of the Mini Shai-Hulud malware family attributed to the threat group TeamPCP. By compromising the GitHub account of open-source maintainer Jared Wray (jaredwray), attackers injected a two-stage credential-harvesting payload into the widely used keyv and cacheable package ecosystems, which then self-propagated to over 440 additional npm packages representing approximately 2 billion combined monthly downloads. A distinguishing technical characteristic is the worm's use of an Ethereum smart contract for dynamic command-and-control infrastructure, a technique known as EtherHiding, which explicitly targets crypto and Web3 developer tooling alongside cloud and CI/CD credentials.","timeline":[{"date":"2025-09-01","event":"Original Shai-Hulud worm debuts, attributed to TeamPCP (UNC6780); marks start of systematic npm/PyPI supply chain campaign.","source":"Tenable Mini Shai-Hulud FAQ","source_url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"date":"2025-11-01","event":"SHA1-Hulud variant introduced with enhanced capabilities.","source":"Tenable Mini Shai-Hulud FAQ","source_url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"date":"2026-03-01","event":"SANDWORM_MODE iteration of the worm introduced.","source":"Tenable Mini Shai-Hulud FAQ","source_url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"date":"2026-04-01","event":"Mini Shai-Hulud (fourth generation) begins operations, introducing SLSA provenance attestation forgery, OIDC token extraction from runner memory, and AI agent persistence hooks.","source":"Tenable Mini Shai-Hulud FAQ","source_url":"https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions"},{"date":"2026-05-11","event":"TanStack attack: TeamPCP compromises GitHub Actions pipeline, publishes 84 malicious versions across 42 @tanstack/* packages in approximately six minutes. CVE-2026-45321 (CVSS 9.6) assigned.","source":"StepSecurity - TeamPCP Mini Shai-Hulud TanStack","source_url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"},{"date":"2026-05-12","event":"TeamPCP open-sources Shai-Hulud worm on GitHub under MIT License with message 'Shai-Hulud: Open Sourcing The Carnage,' announces $1,000 contest for largest supply chain attack using the code.","source":"Akamai - Mini Shai-Hulud: The Worm Returns and Goes Public","source_url":"https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public"},{"date":"2026-05-19","event":"@antv ecosystem attack: 639 malicious versions across 323 packages published in under 30 minutes via stolen maintainer account. Socket detects most within 6.7 minutes.","source":"SafeDep - Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised","source_url":"https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/"},{"date":"2026-08-04","event":"ChainDrop wave begins: attacker uses compromised GitHub account of maintainer jaredwray to push poisoned commit (ee2681a) to keyv monorepo at 09:02:37 UTC, injecting setup.mjs and Math_Symbol.js.","source":"StepSecurity - ChainDrop npm Worm","source_url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"date":"2026-08-04","event":"09:35 UTC: keyv@6.0.0 published via OIDC trusted publishing with valid SLSA attestation. First public security warnings appear at approximately 10:18-10:20 UTC.","source":"Snyk - Inside the keyv npm Supply Chain Compromise","source_url":"https://snyk.io/blog/inside-keyv-npm-compromise-preinstall-malware-trusted-provenance-ide-hooks/"},{"date":"2026-08-04","event":"09:38 UTC onward: automated second-wave propagation begins, with the worm using harvested npm credentials to infect 433 additional packages across @servicetitan, @onereach, @or-sdk, @ornikar, and 10+ other namespaces. 2,212 total malicious versions published within four hours.","source":"StepSecurity - ChainDrop npm Worm","source_url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"date":"2026-08-04","event":"10:39 UTC: npm begins unpublishing affected versions. Cleanup substantially complete by 18:10 UTC.","source":"StepSecurity - ChainDrop npm Worm","source_url":"https://www.stepsecurity.io/blog/chaindrop-npm-worm"},{"date":"2026-08-04","event":"Microsoft Security Blog publishes primary technical analysis by Ravikant Tiwari, Sagar Patil, and Suriyaraj Natarajan.","source":"Microsoft Security Blog - ChainDrop supply chain compromise","source_url":"https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/"},{"date":"2026-08-04","event":"Jared Wray (jaredwray) confirms via X that his GitHub account was compromised; reports using OIDC with npm and one-time codes. States he regained account access at approximately 20:00 UTC and began full audit.","source":"BleepingComputer - ChainDrop npm supply-chain attack","source_url":"https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7eb6c57e-c075-42af-b255-ca4908ed4417copy