← ChainDrop / Mini Shai-Hulud npm Supply Chain Worm (August 2026)reviewed 2026-10-27 · 13 claims checked
Fact-check findings
What an automated fact-checker found when it re-read ChainDrop / Mini Shai-Hulud npm Supply Chain Worm (August 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #4[unverifiable][awaiting moderator]in section: Ethereum Blockchain Command-and-Control (EtherHiding)
“the malware moved between organizations every two to seven minutes during propagation”
reviewerMalware moved between organizations every two to seven minutesNot found in StepSecurity, the lead source. It may appear in another cited source that was not checked. - #12[unverifiable][awaiting moderator]in section: IDE and AI Coding Agent Persistence
“NHS England Digital issued Cyber Alert CC-4781 on the supply-chain attack affecting npm and PyPI packages”
reviewerNHS England Digital issued Cyber Alert CC-4781 on a supply-chain attack affecting npm and PyPI packagesThe page was unreadable. The page's own archive timestamp for this alert is 2026-05-14, which is before ChainDrop (Aug 4), so the alert may describe the May 2026 wave. A human should check.
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #2[stale][awaiting moderator]in section: Attribution and Threat Actor
“No law enforcement action or indictment related to ChainDrop or the broader Shai-Hulud family had been publicly announced as of the input research.”
reviewerNo law enforcement action related to the Shai-Hulud family had been announcedThe statement is superseded for the broader Shai-Hulud family and TeamPCP. The page's own research window ended before the arrests, so it is stale rather than false; ChainDrop-specific action remains unreported.Proposed correction (not yet applied)On August 26, 2026, Australian Federal Police, working with the FBI, arrested two men in Western Australia who are alleged to be TeamPCP members; the reporting links them to Mini Shai-Hulud and other TeamPCP supply-chain attacks but does not mention keyv or ChainDrop, and no arrest or indictment has been publicly tied specifically to ChainDrop.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Ethereum Blockchain Command-and-Control (EtherHiding)
“(by 13:20 UTC according to Elastic)”
reviewerElastic reported 444 packages and 2,212 versions by 13:20 UTCThe counts are supported by StepSecurity, but attributing the 13:20 UTC timestamp and exact counts to Elastic could not be confirmed. The fetch was summarized and may have missed a table or update. - #5[partially supported][awaiting moderator]in section: Credential Harvesting and Cryptocurrency Wallet Targeting
“Unit 42 dates deployment of ChainDrop C2 infrastructure to May 22, 2026.”
reviewerUnit 42 dates deployment of C2 infrastructure to May 22, 2026May 22 is the domain registration date, not deployment of the whole infrastructure. The contract was deployed three days later. The timeline entry for 2026-05-22 repeats the 'deployed' wording. - #6[partially supported][awaiting moderator]in section: Credential Harvesting and Cryptocurrency Wallet Targeting
“Unit 42 confirmed it scans for wallet.dat files associated with the Bitcoin, Dash, Dogecoin, Litecoin and Zcash core clients as well as Electrum wallet files”
reviewerUnit 42 confirmed wallet.dat scanning for several coin clientsBitcoin and Electrum are supported. The list of Dash, Dogecoin, Litecoin and Zcash clients and the 'more than 300 distinct credential patterns' figure were not found in the Unit 42 text. They may come from another source or a different version of the post.
confirmed
7 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“although Palo Alto Networks Unit 42 says it cannot confirm that attribution”
reviewerPalo Alto Networks Unit 42 says it cannot confirm the TeamPCP attributionUnit 42 says in terms that it cannot yet say whether TeamPCP operates ChainDrop. - #7[confirmed][no action needed]in section: Overview and Classification
“prior generations include the original Shai-Hulud worm (September 2025), SHA1-Hulud (November 2025), SANDWORM_MODE (March 2026) and Mini Shai-Hulud (April 2026 onward)”
reviewerPrior generations of the worm family and Mini Shai-Hulud as fourth generationMatches Tenable. Tenable predates ChainDrop, so the ChainDrop label itself rests on other sources. - #8[confirmed][no action needed]in section: Credential Harvesting and Cryptocurrency Wallet Targeting
“at the time of Elastic Security Labs' analysis it returned npm-cache[.]com”
reviewerElastic saw the contract return npm-cache[.]comThe contract address and the domain match Elastic. StepSecurity also names npm-cache.com as the exfiltration domain. - #9[confirmed][no action needed]in section: Payload and Execution Chain
“detects or downloads the official Bun JavaScript runtime (v1.3.13)”
reviewerStage 1 downloads Bun v1.3.13The StepSecurity figures used on the page check out. - #10[confirmed][no action needed]in section: IDE and AI Coding Agent Persistence
“Microsoft's security research team (credited: Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan) published a primary technical analysis on August 4, 2026”
reviewerMicrosoft published a primary technical analysis on August 4, 2026 by named authorsAuthors and date match. Microsoft makes no TeamPCP attribution. - #11[confirmed][no action needed]in section: IDE and AI Coding Agent Persistence
“The Cyber Security Agency of Singapore issued Advisory AD-2026-009 on the attack affecting keyv and related packages”
reviewerCSA Singapore issued Advisory AD-2026-009Title and date match. The advisory ID is shown only in the URL. - #13[confirmed][no action needed]in section: SLSA Provenance Bypass and Evasion Techniques
“Upgrade to npm 12 or later, which does not execute preinstall lifecycle hooks by default and would have blocked the payload.”
reviewernpm 12 or later does not execute preinstall hooks by defaultElastic makes the same recommendation. The 'would have blocked the payload' inference is the page's own addition but follows from the preinstall delivery.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.