Threat reportSupply ChainTL-2026-2285
ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv, cacheable, and 400+ Downstream Packages via Ethereum-Resolved C2
ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv (TL-2026-2285), also tracked as ChainDrop, is a critical-severity supply-chain compromise, first published 2026-09-01. It is attributed to TeamPCP with low confidence, affects keyv (jaredwray) keyv, maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1059), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 1TeamPCP
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-2285
- Threat ID
- TL-2026-2285
- Also known as
- ChainDrop, Mini Shai-Hulud, keyv/cacheable npm supply chain attack
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- TeamPCP
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- softwaredevelopment, technology, financialservices, cloudservices
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv
Malware and tooling: ChainDrop, Shai-Hulud, Bun 1.3.13
How ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv works
On August 4, 2026, attackers compromised the GitHub account of the keyv/cacheable maintainer and published trojanized releases (keyv@6.0.0 and nine sibling packages) carrying a preinstall-hook dropper that fetches the Bun runtime and runs a 727,680-byte obfuscated credential-stealing payload, self-propagating to 1,300+ package versions with combined downloads exceeding 1.3-2 billion/month. The worm, dubbed ChainDrop, is the latest wave of the Shai-Hulud/"Mini Shai-Hulud" campaign lineage and resolves its C2 endpoint dynamically via an Ethereum smart-contract call, evading static domain/hash-based detection.
At approximately 09:00 UTC on August 4, 2026, a threat actor compromised the GitHub account of jaredwray, maintainer of the widely-used keyv (600M+ monthly downloads) and cacheable npm namespaces, and pushed malicious commits directly to the keyv repository's main branch. Within minutes the actor published keyv@6.0.0 along with malicious versions of cacheable-request@13.0.20, cache-manager@7.2.10, @cacheable/utils@2.5.1, flat-cache@6.1.24, and at least five other packages in the same namespaces.
Each trojanized release added a `"preinstall": "node setup.mjs"` entry to package.json. setup.mjs is a base64/RC4-obfuscated stager using control-flow flattening that checks for and downloads the Bun JavaScript runtime v1.3.13 directly from Bun's official GitHub releases (not attacker infrastructure) into a /tmp/bun-dl-*/ staging directory, then hands execution to a 727,680-byte compiled Bun CommonJS bundle named Math_Symbol.js (worm-propagation builds use the filename math_init.js). Running the payload under Bun rather than Node.js gives the malware a current, predictable execution environment regardless of the victim's installed Node version and avoids Node-focused EDR heuristics.
The payload's credential-harvesting component ("collector") scans for npm tokens (.npmrc), GitHub personal-access/session/OIDC tokens (including GitHub Actions ACTIONS_ID_TOKEN_REQUEST_TOKEN/URL), AWS IAM role credentials and Secrets Manager/SSM Parameter Store secrets, GCP/Azure/Alibaba/Tencent cloud credentials, HashiCorp Vault tokens, Kubernetes service-account tokens, database connection strings, CI/CD secrets (Jenkins master.key, Argo CD, Harbor), AI-tooling credentials (Anthropic/Claude, OpenAI, Cursor, Gemini), and cryptocurrency wallets (Foundry, Solana, Monero). Stolen tokens are pre-validated in real time against registry.npmjs.org/-/whoami before exfiltration. Harvested data is gzip-compressed, encrypted with a randomly generated AES-256-GCM key, and that key is itself RSA-encrypted under an attacker-controlled public key before exfiltration.
Rather than hardcoding a C2 domain, the malware queries an Ethereum smart contract (StringListStore, address 0xE1f2395ee43e45A1556EC6438a88c31B83493103) via eth_call through legitimate public RPC endpoints (eth-mainnet.nodereal.io, go.getblock.io, eth.llamarpc.com) to retrieve the current exfiltration endpoint at runtime, blending C2 lookups into normal blockchain-developer network traffic. Observed resolved/fallback exfiltration and staging domains include npm-cache.com, pypi-get.com, js-mirror.com, and the DGA-style awqhnjewqjkl.icu. When smart-contract resolution or direct exfiltration fails, the malware falls back to creating public GitHub repositories under compromised identities (546 identified, description "Shai-Hulud: Here We Go Again", containing a results/ directory) as a dead-drop; per one vendor's analysis the only hosts strictly required for this fallback path are github.com, api.github.com, and registry.npmjs.org, since stolen GitHub tokens alone are sufficient to create repositories and exfiltrate via the authenticated-user API.
Self-propagation logic identifies npm accounts/tokens with publish permission and bypass_2fa enabled reachable from harvested credentials, downloads the latest tarballs of every package the compromised identity maintains, injects the same preinstall hook plus setup.mjs/Math_Symbol.js (or setup_bun.js/bun_environment.js in the related Shai-Hulud "Second Coming"/V2 lineage), and republishes trojanized versions signed under the victim's legitimate identity. Because the republished packages pass through real GitHub Actions build pipelines, they carry valid OpenID Connect and SLSA provenance and Sigstore/Rekor-signed attestations with a green GitHub-verified badge (commit author github-actions[bot]) — the build process is faithfully attested, but the attestation cannot establish that the source entering the pipeline was safe, defeating provenance-based trust checks. Separately, the compromised keyv/cacheable repositories carried IDE-triggered persistence artifacts (.claude/settings.json SessionStart hook calling .vscode/setup.mjs, and .vscode/tasks.json "Environment Setup" task with runOn: folderOpen calling .claude/setup.mjs) that could execute the payload chain merely by opening the cloned repository in VS Code or Claude Code, independent of npm install — both editors' workspace-trust prompts are the only barrier to automatic execution.
By public tracking, 868 packages across 1,381 versions were confirmed poisoned by 13:37 CEST on August 4; later counts rose to 1,684 poisoned versions across 420 package names tied to nine npm organizations (including the @ornikar and @qlik scopes), with combined monthly installs exceeding 1.3–2 billion. npm restored clean prior versions (keyv@5.6.0, flat-cache@6.1.23, cache-manager@7.2.9, cacheable-request@13.0.19) as the `latest` dist-tag later the same day; keyv@6.0.0 itself was pulled from the registry entirely, so lockfiles pinned to it now fail to resolve.
Security researchers link the malware family, filenames, and Bun 1.3.13 toolkit to a broader 2026 campaign lineage attributed with low confidence to the group tracked as TeamPCP (historically also tracked as TA-NATALSTATUS/IronErn): an April 2026 PyTorch Lightning PyPI compromise and a May 2026 @antv npm ecosystem compromise used the identical setup.mjs/Bun 1.3.13 toolkit. Two individuals (Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21) were charged in Perth, Australia on August 27, 2026 with 14 offences tied to a March 2026 TeamPCP supply-chain compromise of Trivy, Checkmarx KICS, and LiteLLM using overlapping infrastructure and staging techniques — but investigators explicitly note the self-identifying markers needed to formally tie this specific keyv/cacheable/ChainDrop incident to a named actor were not recovered, so attribution to TeamPCP for this wave remains unconfirmed.
The incident is the latest in the Shai-Hulud worm lineage: the original Shai-Hulud campaign (detected September 2025) compromised 500+ packages via stolen maintainer tokens and used randomized/generic repository names to evade infrastructure-pattern detection; a second wave ("The Second Coming"/Shai-Hulud V2, detected November 24, 2025) added Bun-runtime loading via setup_bun.js/bun_environment.js (a 480,000+ line obfuscated payload), TruffleHog-based secret scanning, GitHub Actions self-hosted-runner persistence (registered as "SHA1HULUD"), and destructive wiper fallback behavior against the victim's home directory when propagation/exfiltration fails. No CVE or GHSA identifier had been assigned to the keyv/cacheable/ChainDrop compromise at time of research; Snyk tracks it as SNYK-JS-KEYV-18515941 (CWE-506, Embedded Malicious Code) and Mend.io as advisory MSC-2026-6430. Singapore's CSA issued advisory AD-2026-009 covering the ongoing campaign.
The broader ecosystem response accelerated adoption of npm Trusted Publishing (OIDC-based, tokenless package publishing that eliminates long-lived npm tokens as a theft target): weekly Trusted Publishing adoption jumped to roughly 430 packages, and cumulative adoption grew 3.4x over 18 months, driven by Shai-Hulud and at least 14 related supply-chain incidents including this one. Detection-methodology analysis of this and the Shai-Hulud incidents (the hunt source for this record) argues that hash- and named-indicator detection (the base of the Pyramid of Pain) catches only already-known artifacts, while durable detection requires behavioral/TTP-level rules on the shape of the attack — preinstall-script network egress, unexpected runtime downloads (Bun fetched by a package that has no reason to need it), and credential-file access patterns — rather than rotating IOCs.
MITRE ATT&CK techniques used in TL-2026-2285
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise
Discovery
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
lateral-movement
T1550 Use Alternate Authentication Material
defense-impairment
Exfiltration
T1567 Exfiltration Over Web Service
Command and Control
Resource Development
Affected products and versions in ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv
- keyv (jaredwray) — keyv
Vulnerable versions: 6.0.0
Fixed in: 5.6.0 (restored latest) - keyv (jaredwray) — cacheable-request
Vulnerable versions: 13.0.20
Fixed in: 13.0.19 (restored latest) - keyv (jaredwray) — cache-manager
Vulnerable versions: 7.2.10
Fixed in: 7.2.9 (restored latest) - keyv (jaredwray) — flat-cache
Vulnerable versions: 6.1.24
Fixed in: 6.1.23 (restored latest) - keyv (jaredwray) — @cacheable/utils
Vulnerable versions: 2.5.1 - npm ecosystem (downstream) — @ornikar and @qlik scoped packages and ~400+ other downstream packages across 9 npm organizations
Vulnerable versions: versions republished on/after 2026-08-04
Remediation for ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv
Patches
- Pin dependencies to the restored clean versions: keyv@5.6.0, flat-cache@6.1.23, cache-manager@7.2.9, cacheable-request@13.0.19 (keyv@6.0.0 has been removed from the registry entirely)
Immediate actions
- Remove keyv, cacheable-request, cache-manager, @cacheable/utils, flat-cache, and other keyv/cacheable-namespace packages published on or after August 4, 2026 09:00 UTC from all development, build, and CI/CD environments; search lockfiles for keyv-6.0.0.tgz and equivalent trojanized version references
- Run npm install with --ignore-scripts or otherwise disable lifecycle (preinstall/postinstall) scripts by default while triaging
- Search for and remove persistence artifacts (setup.mjs, Math_Symbol.js, math_init.js, .claude/settings.json, .vscode/tasks.json, /tmp/bun-dl-* directories) BEFORE rotating credentials — the malware installs a token-revocation watcher that can trigger attacker handlers if rotation happens first
- Audit GitHub accounts for unexpected repository creation (description pattern "Shai-Hulud: Here We Go Again"), unauthorized commits, and unexpected OIDC/PAT usage
Workarounds
- Rotate all potentially exposed credentials after artifact removal: npm tokens, GitHub PATs/OIDC, AWS/GCP/Azure/Alibaba/Tencent cloud keys, HashiCorp Vault tokens, Kubernetes service-account tokens, database connection strings, CI/CD secrets (Jenkins, Argo CD, Harbor), and cryptocurrency wallet keys
- Re-key affected secrets in AWS Secrets Manager, SSM Parameter Store, and Vault rather than merely revoking
Longer-term hardening
- Migrate npm publishing workflows to npm Trusted Publishing (OIDC-based, tokenless) to eliminate long-lived npm tokens as a theft/republish target
- Enforce mandatory 2FA on all npm publish-capable accounts and disable bypass_2fa token grants
- Adopt behavioral/TTP-level detection (preinstall-script network egress, unsolicited runtime downloads, unexpected DNS to blockchain RPC endpoints) rather than relying solely on hash/domain indicator feeds, per the Pyramid of Pain
- Implement dependency allowlisting and package-integrity/provenance verification that accounts for compromised-but-legitimately-signed builds, not just signature presence
Weaknesses (CWE) in ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv
Timeline of ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv
- Original Shai-Hulud npm worm compromises 500+ packages via stolen maintainer tokens, using randomized repository names to evade infrastructure-pattern detection; becomes the primary catalyst for npm Trusted Publishing adoption
- Shai-Hulud "Second Coming" / V2 detected: adds setup_bun.js/bun_environment.js Bun-runtime loader, TruffleHog secret scanning, GitHub Actions self-hosted-runner persistence (named SHA1HULUD), and destructive wiper fallback
- TeamPCP-linked supply-chain compromise of Trivy, Checkmarx KICS, and LiteLLM using overlapping infrastructure and staging techniques
- PyTorch Lightning PyPI package compromised using identical setup.mjs dropper and Bun 1.3.13 toolkit later reused in the keyv/cacheable attack
- @antv npm ecosystem compromise tied to TeamPCP using the same toolkit lineage
- Full payload technical breakdown (obfuscation, credential targets, exfiltration mechanics) published by responding researchers (19:50 UTC)
- npm restores clean prior versions (keyv@5.6.0, flat-cache@6.1.23, cache-manager@7.2.9, cacheable-request@13.0.19) as the latest dist-tag; malicious keyv@6.0.0 removed from the registry entirely
- Ethereum smart-contract-based dynamic C2 domain resolution mechanism documented by researchers (15:00 UTC)
- First indicator-of-compromise disclosures published by responding security vendors (13:45 UTC)
- Self-propagation logic republishes trojanized versions across 353+ packages within roughly 30 minutes, rising to 868 packages/1,381 versions by 13:37 CEST and ultimately 1,684 poisoned versions across 420 package names in nine npm organizations
- keyv@6.0.0 and nine sibling packages across the keyv/cacheable namespaces published with the setup.mjs preinstall-hook dropper within minutes of the account compromise
- Attacker compromises maintainer jaredwray's GitHub account at approximately 09:00 UTC and pushes malicious commits to the keyv repository main branch
- Singapore Cyber Security Agency issues advisory AD-2026-009 on the ongoing npm supply-chain attack affecting keyv and related packages
- Two alleged TeamPCP members (Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21) charged in Perth, Australia with 14 offences tied to the related March 2026 Trivy/Checkmarx KICS/LiteLLM supply-chain compromise; investigators state markers tying them specifically to the keyv/ChainDrop wave were not recovered
- Aikido Security publishes "The dark figure of supply chain detection," using the Keyv and Shai-Hulud incidents to argue that hash/named-indicator detection catches only known artifacts and that durable defense requires behavioral/TTP-level detection rules
Sources cited for ChainDrop/Mini Shai-Hulud npm Worm Compromises keyv
- The dark figure of supply chain detection
- The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign
- keyv and cacheable compromise
- keyv and cacheable npm Package Hijacked in Supply Chain Attack
- Malicious keyv Package on npm Steals CI Secrets via GitHub
- Shai-Hulud/CHAINDROP npm Supply Chain Worm
- Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
- Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
- Inside the keyv npm Supply Chain Compromise
- Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages (AD-2026-009)
- Shai-Hulud was the best thing to happen to supply chain security
Detection coverage for TL-2026-2285
As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2285 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.