A new supply chain attack, dubbed "CHAINDROP" by researchers, has compromised over 400 npm packages, impacting libraries with over 1.3 billion monthly downloads. The attack, identified by Elastic Security Labs on August 4, 2026, involved the trojanization of the `keyv` monorepo and the deployment of a self-propagating worm. This campaign marks a return of the "Shai-Hulud" threat actor.
The initial compromise targeted the maintainer of `keyv`, a widely used key-value storage library. The worm then leveraged stolen npm credentials to backdoor other packages to which the maintainer had publish rights. Key affected packages include `keyv` (over 600 million monthly downloads), `flat-cache` (nearly 580 million), `cacheable-request` (over 137 million), `cacheable` (over 30 million), and `cache-manager` (over 16 million).
The CHAINDROP worm operates via a `preinstall` hook in `package.json`, a legitimate npm feature that executes arbitrary commands before package installation. Every subpackage in the `keyv` repository was injected with a dropper, `setup.mjs`, which delivers the primary payload. The malware is designed for cross-platform compatibility, targeting Linux, macOS, and Windows.
The payload manifests as `Math_Symbol.js` in packages directly compromised from the `keyv` monorepo and `math_init.js` in packages infected during worm propagation. Both files share an identical SHA-256 hash. Worm-generated commits can be identified by the author name "claude" and the commit message "chore: update config".
Beyond npm package installation, the threat actor implemented additional execution paths. For users of Claude Code, a `SessionStart` hook in `settings.json` under the Claude directory will execute `node .claude/setup.mjs` upon session initiation. Similarly, for VS Code users, a `folderOpen` task in `tasks.json` will run `node .vscode/setup.mjs` when an infected repository is opened. If a stolen GitHub App token is available, the worm extends this by committing malicious hooks to up to 50 branches per accessible repository, injecting `.claude/settings.json` and `.vscode/tasks.json` into each.
The dropper, `setup.mjs`, first checks for the presence of the `bun` JavaScript runtime. If `bun` is not found, it detects the system's platform and architecture, then downloads `bun v1.3.13` directly from its official release page. After extraction, `bun` is used to execute the obfuscated payload, `Math_Symbol.js`. The temporary `bun` directory is subsequently deleted to obscure its activity.
The payload, a 711-kilobyte file, is heavily obfuscated using control-flow flattening and a Base91 string encoding scheme. It contains references to the "Dune" science fiction series, such as "laza," "kanly," and "sandworm," and exhibits similarities to previous Shai-Hulud campaigns.
A key component of the payload is a "collector" module designed for credential harvesting. This module scans for over 300 unique patterns across various credential stores on a developer's machine. It specifically targets AI tooling credentials from providers like Anthropic, Claude, Codex, Cursor, OpenAI, and Gemini, as well as cloud provider credentials for AWS, GCP, Azure, and Alibaba Cloud. Other targeted credentials include GitHub Personal Access Tokens (PATs), JWTs, session tokens, HashiCorp Vault tokens, SSH private keys, Kubernetes service account tokens, and npm tokens.
Stolen credentials are gzip-compressed and then encrypted with a randomly generated AES-256-GCM key. This AES key is subsequently RSA-encrypted using the attacker's hardcoded public key, ensuring that only the attacker with the corresponding private key can decrypt the data.
CHAINDROP does not hardcode a command-and-control (C2) domain. Instead, it queries an Ethereum smart contract at address `0xE1f2395ee43e45A1556EC6438a88c31B83493103` to retrieve the current exfiltration endpoint at runtime, utilizing multiple RPC providers as fallbacks. This mechanism allows the attacker to rotate C2 infrastructure without modifying the payload. During detonation runs, observed dead-drop domains included `awqhnjewqjkl[.]icu` and `npm-cache[.]com`.
If smart contract discovery fails, CHAINDROP searches GitHub commit history for a cryptographically signed marker, "thebeautifulmarchoftime," and validates any discovered C2 domain against an embedded RSA public key. As a final fallback, if both previous methods fail, CHAINDROP will exfiltrate data via a public GitHub repository, using "Dune"-themed names and the compromised victim’s account, with the description "Shai-Hulud: Here We Go Again."
The worm component activates upon the discovery of an npm token, provided the token has package write permissions and the ability to publish without two-factor authentication (`bypass_2fa`). Once a suitable token is found, the worm enumerates all packages the victim has publish rights to. For each writable package, it downloads the latest tarball from the npm registry, extracts it, injects the malicious components (`math_init.js` or `Math_Symbol.js` and `setup.mjs`), patches `package.json` to add the `preinstall` hook, bumps the patch version, and then re-packages and publishes the updated package back to the npm registry.
In this campaign, the commit message for these malicious updates includes the stolen GitHub token along with the string "IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients," an apparent attempt to deter developers from revoking the token.
