Latest Threats

linking threat corpus_

ChainDrop npm Supply-Chain Compromise: Self-Propagating Mini Shai-Hulud Credential-Stealing Worm Affecting 444+ Packages — Threadlinqs Intelligence

As of 2026-08-07, ChainDrop npm Supply-Chain Compromise: Self-Propagating Mini Shai-Hulud Credential-Stealing Worm Affecting 444+ Packages is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 45 indicators of compromise.

Threat ID: TL-2026-1875 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN

Updated: 2026-08-07 · 3 updates · revalidated 3× · latest source

Attribution: TeamPCP · FINANCIAL

ChainDrop is a large-scale npm supply-chain attack affecting 444+ packages (2,212 malicious versions) across 14+ unrelated publisher organizations, delivered via a Mini Shai-Hulud self-propagating

On August 4, 2026 (UTC), the npm ecosystem experienced one of the most sophisticated supply-chain attacks ever recorded. Dubbed ChainDrop, the attack propagated via a Mini Shai-Hulud variant worm that poisoned 444 packages (2,212 versions) in under four hours, affecting packages with a combined 2+ billion monthly installs. The attack began with the compromise of the GitHub account of Jared Wray, maintainer of the Keyv package (153.7M weekly downloads), and rapidly spread across the jaredwray ecosystem to packages including flat-cache (149.9M), file-entry-cache (147.6M), cacheable-request, cache-manager, ecto, and then autonomously propagated to 433 additional packages across 14+ organizations including ServiceTitan, OneReach, Ornikar, Qlik, Picsart, and Deliveroo. The initial compromise was achieved via stolen GitHub maintainer credentials, not an npm token — the attacker pushed unsigned commits directly to the main branch and triggered legitimate release workflows configured with OIDC trusted publishing. This meant that every malicious version from the jaredwray wave carried valid SLSA provenance attestation signed by GitHub Actions. The resulting provenance accurately recorded the poisoned commit hash; it could not prove the commit was authorized. The worm delivery mechanism exploits npm's preinstall lifecycle hook. Each poisoned package includes a setup.mjs file (29,918 bytes, wave 1; 11,017 bytes, re-obfuscated wave 2) and a heavily obfuscated 727,680-byte Bun-bundled second-stage payload (Math_Symbol.js or math_init.js). When npm install runs, the preinstall hook executes setup.mjs via Node.js, which downloads the legitimate Bun v1.3.13 JavaScript runtime from the official oven-sh/bun GitHub release and uses it to detonate the second-stage worm. The worm downloads a platform-specific Bun binary (Linux x64 glibc/musl, Linux arm64, macOS x64/arm64, Windows x64/arm64) and cleans up the staging directory afterward. If Bun is already installed, the download is skipped. The second-wave dropper variant includes a hand-rolled minimal ZIP extractor with PowerShell Expand-Archive fallback on Windows. The stage 2 payload (727,680 bytes) is a Bun-bundled CommonJS program with three obfuscation layers: a rotated 1,283-entry string table with custom charset decoder, anti-tamper Object hardening, and AES-256-GCM encrypted configuration blobs. Its startup sequence includes a Russian-locale kill switch (exits if LANG indicates a Russian locale — a classic CIS avoidance pattern), a detached self-respawn mechanism outside GitHub Actions, and anti-debug checks. It writes a camouflaged state file at $TMPDIR/tmp.dpkg_<pid>.lock disguised as a dpkg lock. The credential harvesting subsystem targets approximately 140 filesystem paths across 19 categories. These include npm tokens (~/.npmrc, ~/.yarnrc), GitHub tokens (via gh auth token and filesystem scanning), AWS credentials (~/.aws/credentials, config, IMDSv2, ECS metadata), Azure tokens (az account get-access-token, ~/.azure/accessTokens.json), Google Cloud (~/.config/gcloud, gcloud config config-helper), Docker (~/.docker/config.json), Kubernetes (~/.kube/config, in-cluster API enumeration), SSH keys (~/.ssh/), HashiCorp Vault (token discovery, Kubernetes auth, AWS IAM auth, KV v1/v2 path walk across all mounts), Jenkins (master.key), Terraform state files, PostgreSQL and MySQL connection strings, and cryptocurrency wallet.dat files (Bitcoin, Dash, Dogecoin, Litecoin, Zcash, Electrum). The worm also performs AWS Secrets Manager ListSecrets/GetSecretValue and SSM GetParameters calls across 16 regions, and Kubernetes namespace-wide secret enumeration. A distinctive new capability in this generation targets AI developer tools — credential stores for Claude Code (.claude/credentials.json, .claude.json), OpenAI (.openai/auth.json), Codex (.codex/auth.json), Cursor (.cursor/credentials.json), Anthropic (.anthropic/auth.json), Gemini (.gemini/.env), OpenClaw, OpenCode, Hermes, and Kiro. The wor

MITRE ATT&CK Techniques

T1078 Valid Accounts; T1195 Supply Chain Compromise; T1204 User Execution; T1059 Command and Scripting Interpreter; T1543 Create or Modify System Process; T1098 Account Manipulation; T1548 Abuse Elevation Control Mechanism; T1027 Obfuscated Files or Information; T1036 Masquerading; T1608 Stage Capabilities; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1003 OS Credential Dumping; T1082 System Information Discovery; T1614 System Location Discovery; T1046 Network Service Discovery; T1087 Account Discovery; T1069 Permission Groups Discovery; T1005 Data from Local System; T1213 Data from Information Repositories; T1119 Automated Collection; T1573 Encrypted Channel; T1071 Application Layer Protocol; T1008 Fallback Channels; T1205 Traffic Signaling; T1546 Event Triggered Execution; T1055 Process Injection; T1564 Hide Artifacts; T1528 Steal Application Access Token; T1083 File and Directory Discovery; T1526 Cloud Service Discovery; T1102 Web Service; T1105 Ingress Tool Transfer; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service; T1070 Indicator Removal; T1497 Virtualization/Sandbox Evasion; T1074 Data Staged; T1041 Exfiltration Over C2 Channel; T1020 Automated Exfiltration

Weaknesses (CWE)

CWE-494, CWE-506, CWE-829, CWE-1104, CWE-306, CWE-522, CWE-276, CWE-269, CWE-311, CWE-94

Target sectors: softwaredevelopment, technology, cloudcomputing, cybersecurity, devops, ecommerce, health, financialservices

Target regions: Global

Update History

2026-08-07 — ChainDrop npm Supply-Chain Worm (Shai-Hulud: Here We Go Again) Compromises 868+ Packages, Harvests Developer Secrets: What changed No escalation to severity_level, exploitability, status, or cvss_score — all unchanged (CRITICAL/ACTIVE/ACTIVE). No field_changes applied. New indicators (1) 1 new behavioral IOC: malicious branch-name pattern 'dependabot/githu
2026-08-06 — ChainDrop — Self-Propagating npm Worm Compromises 400+ Packages Via Shai-Hulud Variant with Ethereum Dead-Drop C2: What changed No escalation to severity, exploitability, or status — both remain CRITICAL / ACTIVE. The newer report adds a post-wave C2 domain rotation and a detailed pre-attack infrastructure/funding timeline not previously captured. New i
2026-08-06 — ChainDrop (Shai-Hulud 2.0) Self-Propagating npm Worm Compromises keyv, cacheable, and 400+ Packages via Account Takeover with EtherHiding Blockchain C2: What changed No escalation to existing severity/exploitability/status (remains CRITICAL/ACTIVE/ACTIVE). This report is an independent corroborating writeup (JFrog, StepSecurity, Datadog, Wiz, Sygnia, et al.) of the same August 4, 2026 Chain

References

Related threats

Detections & IOCs

As of 2026-08-23, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 45 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.

SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1078, T1195, T1204, T1059, T1543, T1098, T1548, T1027, T1036, T1608

Threadlinqs Intelligence — Real-Time Threat Detection Platform

Latest Threats

🔄 Threat Comparison