ChainDrop: Anatomy of a 4-Hour Software Supply-Chain Attack

On the morning of 4 August 2026, someone pushed a poisoned commit to the GitHub repository of keyv, one of the most-installed packages in the JavaScript ecosystem. Within four hours, a self-propagating worm had spread to 444+ npm packages across 2,212+ malicious versions [1][4]. Researchers named the campaign ChainDrop and the malware Mini Shai-Hulud — a heavily evolved descendant of the worm family that tore through npm in late 2025 [1][2][4]. The affected packages are present in more than 46% of cloud environments, and the worm was built to steal cloud credentials, GitHub and npm tokens, AI configuration files, and cryptocurrency wallets [1]. This post breaks the incident down into the eight Ws: what happened, why it matters, who did it, when and where, which packages, how it worked, and what to do next.

What happened: a four-hour window

The attack began at 09:00 UTC on 4 August 2026, when the attacker compromised the GitHub account of Jared Wray, the maintainer of keyv [1][6]. Two minutes later, at 09:02, a poisoned commit landed in the jaredwray/keyv repository. Because the malicious code was committed to the tagged repository, the project's own legitimate release workflow — complete with OIDC trusted publishing and valid SLSA provenance — built and published the malware as if it were a normal release [6]. At 09:35, keyv@6.0.0 went live on npm [4][6].

What followed was the fastest self-propagation ever recorded in the npm ecosystem. Between 09:38 and 13:20, the worm automatically backdoored 433 additional packages using stolen npm tokens, republishing malicious versions of every package the compromised maintainers had publish rights to [4]. npm began unpublishing the malicious versions at 10:39, but the initial wave was over in less than four hours [1][4].

Why it matters: the blast radius

ChainDrop did not target obscure packages. It started with the caching libraries that sit underneath a huge share of the JavaScript ecosystem. The 11 "full worm carriers" — packages that shipped the complete worm payload — include keyv (~153.7M weekly downloads), flat-cache (~149.9M), file-entry-cache (~147.6M), and cacheable-request (~34M) [4].

From those carriers, the worm propagated to 433 more packages across organizations including ServiceTitan (141 packages), OneReach (78), or-sdk (74), Ornikar (42), Qlik (28), and nebula.js (22), as well as Deliveroo and Picsart [4]. CyberScoop reports the reach expanded to more than 860 packages with over 2 billion monthly installs [1], while BleepingComputer counted at least 868 packages across 1,381 versions [5]. Because these are foundational utilities, the worm's reach is measured in environments, not downloads: the affected packages are present in more than 46% of cloud environments [1].

Who was behind it

Security researchers attribute the campaign to the actor known as TeamPCP, who used multiple stolen tokens to move through the ecosystem [1]. The malware is a variant of the Mini Shai-Hulud family — a heavily evolved descendant of the Shai-Hulud 2.0 worm that compromised hundreds of npm packages in November 2025 [1][2][4]. The code carries Dune-themed strings ("laza, kanly, ghola, mentat, lasgun, sietch, fedaykin") and a Russian-locale kill switch that avoids infecting systems in CIS countries — a fingerprint consistent with the earlier campaigns [2][4].

When and where

When: 4 August 2026, beginning at 09:00 UTC; the initial wave lasted under four hours [1][4]. Where: the compromise happened on GitHub (a hijacked maintainer account), the distribution happened through the npm registry, and the command-and-control ran on the Ethereum blockchain. The worm resolves its exfiltration endpoints at runtime by querying an Ethereum smart contract (0xE1f2395ee43e45A1556EC6438a88c31B83493103) — a technique called EtherHiding that leaves no hardcoded domain to sinkhole [2][4]. Observed exfiltration domains include npm-cache[.]com and awqhnjewqjkl[.]icu, with traffic encrypted using AES-256-GCM and RSA-OAEP [2][4].

How the worm worked

The infection chain is a study in living off the land. The malicious package.json declares a "preinstall": "node setup.mjs" hook, which runs automatically whenever a developer runs npm install [4][6]. The setup.mjs dropper downloads the legitimate Bun v1.3.13 runtime from official GitHub releases — a trusted binary that many security tools ignore — and uses it to execute the second stage, a 727,680-byte obfuscated worm called Math_Symbol.js (or math_init.js) [4].

Once running, the worm scans for more than 300 patterns of secrets [2]. Its harvest list includes npm and GitHub tokens, AWS, GCP and Azure credentials, Vault and Kubernetes secrets, SSH keys, database connection strings, /etc/shadow, AI tool credentials for Claude, Codex, Cursor, OpenAI and Gemini, and cryptocurrency wallets [2][3][4][6]. It even scrapes GitHub Actions runner memory for values flagged "isSecret": true [4].

Persistence is layered. The worm plants a SessionStart hook in .claude/settings.json (Claude Code), a folderOpen task in .vscode/tasks.json (VS Code), and hooks into GitHub Copilot workflows — so the malware re-executes every time the developer opens an editor [2][3][4][6]. It also installs a gh-token-monitor that fires a payload if a stolen GitHub token is revoked, punishing incident response [4][6].

The most uncomfortable detail is that the supply-chain trust model worked exactly as designed. Because the malicious code lived in the tagged repository, the legitimate release workflow built and attested the malicious artifact with valid provenance [6]. Provenance proves who published a package, not why — and when the publisher's account is the attacker, the attestation becomes a liability.

The historical parallel: Shai-Hulud 2.0 and the 2021 wave

ChainDrop is the third act of a story that began in September 2025, when the original Shai-Hulud worm compromised hundreds of npm packages and was linked to roughly $50 million in cryptocurrency theft [7]. In November 2025, Shai-Hulud 2.0 ("The Second Coming") escalated: 621 infected packages, more than 25,000 malicious GitHub repositories across ~487 organizations, and 14,206 leaked secrets — of which 2,485 were still valid, including 775 GitHub tokens, 373 AWS credentials, 300 GCP credentials, and 115 Azure credentials [7][8]. It used the same preinstall hook and Bun runtime tricks, registered infected machines as self-hosted GitHub runners, and wiped home directories if credential theft failed [7][8].

The pattern goes back further. In October 2021, the ua-parser-js package was compromised via a maintainer account takeover and shipped a Monero miner and the DANABOT banking trojan through a preinstall script; the same actor (tracked as UNC3379) hit coa and rc weeks later [9][10]. In 2018, event-stream was handed to a social engineer who hid a wallet-stealing payload inside a dependency [9].

The trajectory is unmistakable: each iteration is faster, wider, and more automated. The 2021 attacks took hours to reach three packages. Shai-Hulud 2.0 took days to reach hundreds. ChainDrop reached 444+ packages in under four hours — and it did so by weaponizing the ecosystem's own trust mechanisms.

What next: remediation and the future outlook

For anyone who may have installed an affected version, the guidance from researchers is consistent [3][4][5][6]:

• Pin or downgrade to a last-known-good version — for example keyv@5.6.0 or flat-cache@6.1.23 [4].
• Treat affected systems as fully compromised. Rotate every credential that was accessible from the environment, from a clean machine, and rebuild from safe backups or from scratch [3][5].
• Remove the gh-token-monitor persistence before revoking tokens, or the revocation itself triggers the payload [4][6].
• Install with npm install --ignore-scripts where possible, and audit lifecycle scripts in CI/CD [4][6].
• Enforce release cooldowns and minimum release age policies so a brand-new version cannot propagate ecosystem-wide in minutes [4].

The longer-term outlook is sobering. ChainDrop shows that trusted publishing and provenance — the industry's flagship supply-chain defenses — do not stop an attacker who controls the repository. The next iteration will likely target AI tooling credentials even harder, since those now gate access to code, cloud, and data. Expect faster takedowns, but also expect attackers to keep compressing the window between first compromise and ecosystem-wide spread. The four-hour ChainDrop window is not a worst case; it is the new baseline.

References

1. CyberScoop — Supply chain attack spreads malware via popular npm packages
2. Elastic Security Labs — Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
3. Wiz — keyv and cacheable npm package hijacked in supply chain attack
4. StepSecurity — ChainDrop npm worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2
5. BleepingComputer — Massive ChainDrop npm supply-chain attack infects hundreds of packages
6. Snyk — Inside the keyv npm compromise: preinstall malware, trusted provenance, IDE hooks
7. Check Point Research — Shai-Hulud 2.0: Inside the Second Coming, the most aggressive npm supply chain attack of 2025
8. Wiz — Shai-Hulud 2.0 supply chain attack: 25K+ repos exposed
9. Mandiant / Google Cloud — No unaccompanied miners: supply chain compromises through Node.js packages
10. Sonatype — npm hijackers at it again: popular coa and rc open source libraries taken over to spread malware