npm Ecosystem Under Siege: Multi-Campaign Supply-Chain Attacks Using Blockchain Smart Contracts for Takedown-Resistant C2 (EtherHiding) — Threadlinqs Intelligence
As of 2026-08-04, npm Ecosystem Under Siege: Multi-Campaign Supply-Chain Attacks Using Blockchain Smart Contracts for Takedown-Resistant C2 (EtherHiding) is a critical-severity supply chain threat attributed to Shai-Hulud, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1866 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Shai-Hulud · ESPIONAGE
Multiple coordinated and self-propagating supply-chain campaigns in 2025–2026 are targeting the npm ecosystem by storing C2 server addresses inside Ethereum, Polygon, and BNB Smart Chain smart
## Background and Technique
EtherHiding, first documented by Guardio in October 2023, is a technique where malware retrieves its command-and-control server address from a blockchain smart contract rather than hardcoding an IP or domain. The attacker deploys a simple contract with a public getter function — the malware issues an eth_call (a read-only RPC method that costs no gas) to one or more public RPC endpoints, decodes the ABI-encoded response, and extracts the current C2 address. Since the contract lives immutably on the blockchain and every full node serves its data, there is no central server to seize or domain to sinkhole — the operator updates the C2 by simply calling the contract's setter, and all deployed malware instances immediately resolve the new address on their next beacon cycle.
## ChainDrop Worm (August 4, 2026) — The Most Severe Incident
ChainDrop, documented by StepSecurity, is a self-propagating supply-chain worm and the most destructive manifestation of EtherHiding to date. On August 4, 2026, an attacker compromised the GitHub account of jaredwray — maintainer of the keyv/cacheable ecosystem — and pushed unsigned but plausible commits directly to main without branch protection. The attacker injected setup.mjs (a cross-platform runtime downloader) and Math_Symbol.js (a 727 KB heavily obfuscated stage-2 worm) into 11 core packages under the jaredwray namespace.
The project's own release workflow published keyv@6.0.0 via OIDC Trusted Publishing, generating valid SLSA provenance attestation — the provenance proved which commit was built, but could not prove the commit was authorized. The preinstall hook ("preinstall": "node setup.mjs") fired during every npm install.
setup.mjs detects the operating system (Linux x64/arm64, macOS x64/arm64, Windows x64/arm64) and downloads the official Bun runtime from github.com/oven-sh/bun/releases/download/bun-v1.3.13/ — living off the land with a real, signed binary. Bun then executes Math_Symbol.js, which is protected by three layers of obfuscation: (1) a rotated 1,283-entry string table with a custom charset decoder, (2) anti-tamper Object hardening, and (3) AES-256-GCM encrypted configuration blobs. Runtime analysis recovered 4,613 decoded strings.
The worm resolves C2 from the Ethereum mainnet contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103 via eth_call selector 0x53ed5143, trying 75 public RPC endpoints in order. If the contract is unreachable, it falls back to searching GitHub commits for signed markers (thebeautifulmarchoftime, IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients) to locate fallback infrastructure. The observed exfiltration domain is npm-cache.com, receiving POST requests to /router.
Exfiltration is analyst-proof: gzip(JSON loot) → AES-256-GCM with a random per-run key → RSA-OAEP-SHA256 key wrapping using an embedded public key → base64. Only the operator's private key can decrypt captured traffic. The C2 channel is bidirectional — if the response contains a code field, the worm executes it via eval(), enabling live remote access.
Within four hours, the worm propagated from the 11 initial jaredwray carriers to 433 additional packages across 14+ compromised org namespaces including @servicetitan (141 packages), @onereach (78), @or-sdk (74), @ornikar (42), @qlik (28), @nebula.js (22), and others. Each victim's own npm tokens and GitHub credentials fueled the next infection — the worm publishes malicious packages using the compromised maintainer's OIDC identity and self-generates Sigstore + Rekor provenance bundles. It also planted persistence hooks targeting Claude Code (.claude/settings.json), VS Code (.vscode/tasks.json), and GitHub Copilot workflows.
The worm contains a Russian locale kill switch — if the LANG environment variable indicates Russian, it prints "Exiting as russian language detected!" and halts execution, suggesting CIS-avoidance or Russian-speaking operators. A dead man's switch in the token mon
Weaknesses (CWE)
CWE-494, CWE-1104, CWE-829
Target sectors: technology, finance, software-development, cryptocurrency
Target regions: North America, Europe, Asia
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1059, T1204, T1546, T1547, T1554, T1053, T1027, T1553, T1036
