Data by Hatching Triage LinuxmacOSWindows

ChainDrop

ChainDrop is a self-propagating npm supply-chain worm and credential-stealing malware strain derived from the Shai-Hulud or Mini Shai-Hulud lineage.

Profile source: Mallory

ChainDrop

Family profile

ChainDrop is a self-propagating npm supply-chain worm and credential-stealing malware strain derived from the Shai-Hulud or Mini Shai-Hulud lineage. It emerged in August 2026 after attackers compromised npm maintainer and GitHub publishing access associated with widely used JavaScript packages, then inserted malicious preinstall logic into legitimate package releases. The malware preserves normal package functionality while adding install-time execution, allowing routine dependency installation on developer workstations and CI/CD runners to trigger compromise.

Execution is typically initiated through malicious npm preinstall lifecycle scripts that launch a dropper and an obfuscated JavaScript payload, often via the Bun runtime. Once active, ChainDrop harvests a broad range of secrets from local files, environment variables, shell history, SSH material, developer-tool configuration, cloud and container tooling, Kubernetes and Vault data, and CI/CD contexts. Multiple reports also describe theft of npm tokens, GitHub credentials, cloud-provider credentials, and extraction of temporary secrets from GitHub Actions runner memory. Stolen data is compressed and encrypted before exfiltration.

ChainDrop’s defining behavior is autonomous propagation. When it obtains npm publishing credentials with sufficient rights, it enumerates packages writable by the victim, injects its malicious components into package archives or repositories, modifies lifecycle scripts, increments package versions, and republishes trojanized releases through legitimate maintainer identities and trusted CI/CD workflows. This enabled rapid spread across hundreds of packages and, in some reporting, well over a thousand package versions. The campaign abused legitimate GitHub Actions and trusted publishing paths, allowing malicious releases to retain valid provenance artifacts in some cases.

The malware also establishes persistence in developer environments by planting hooks in repository settings used by Visual Studio Code and Claude Code so that opening a workspace or starting an AI-assisted coding session can re-trigger execution even without a fresh package install. Some reporting further describes fallback exfiltration through public GitHub repositories created under victim identities and dynamic command-and-control resolution via an Ethereum smart contract, complicating infrastructure-based blocking.

ChainDrop has been linked by multiple researchers to the broader Shai-Hulud ecosystem and associated by some reporting with TeamPCP, although operator attribution is not uniformly confirmed. Its impact extends beyond endpoint compromise to software release pipelines, source repositories, package registries, and cloud infrastructure, making it a high-severity software supply-chain threat to JavaScript development environments and organizations that consume affected npm packages.

Capabilities

Credential Theft
Defense Evasion
Exfiltration
Persistence
Post Exploitation

Observed infrastructure

Last seven days

First activity: Aug 15, 2026
Last activity: Aug 15, 2026
Feed role: C2
Host form: 0 IP / 3 hostnames

Reported operators

Threat actors

2 named in public reporting

TeamPCP

On August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP.

Shai-Hulud

The attackers trojanized the monorepo and embedded a self-propagating worm called CHAINDROP that uses stolen npm credentials to automatically backdoor every other package the maintainer had publish rights to.

MITRE ATT&CK

ChainDrop in ATT&CK

53 distinct techniques

Techniques

53 techniques

T1059 Command and Scripting Interpreter T1574 Hijack Execution Flow T1195 Supply Chain Compromise T1528 Steal Application Access Token T1070 Indicator Removal T1526 Cloud Service Discovery T1567.001 Exfiltration to Code Repository T1497.001 System Checks T1555 Credentials from Password Stores T1071 Application Layer Protocol T1568 Dynamic Resolution T1546 Event Triggered Execution T1083 File and Directory Discovery T1567 Exfiltration Over Web Service T1560 Archive Collected Data T1552.005 Cloud Instance Metadata API T1078 Valid Accounts T1105 Ingress Tool Transfer T1649 Steal or Forge Authentication Certificates T1195.001 Compromise Software Dependencies and Development Tools T1552 Unsecured Credentials T1518 Software Discovery T1041 Exfiltration Over C2 Channel T1204.002 Malicious File T1027 Obfuscated Files or Information T1055 Process Injection T1552.001 Credentials In Files T1059.004 Unix Shell T1543.002 Systemd Service T1543.001 Launch Agent T1543 Create or Modify System Process T1001 Data Obfuscation T1053 Scheduled Task/Job T1059.007 JavaScript T1570 Lateral Tool Transfer T1583.001 Domains T1213 Data from Information Repositories T1588.004 Digital Certificates T1567.002 Exfiltration to Cloud Storage T1071.001 Web Protocols T1008 Fallback Channels T1539 Steal Web Session Cookie T1574.007 Path Interception by PATH Environment Variable T1070.004 File Deletion T1119 Automated Collection T1055.009 Proc Memory T1003 OS Credential Dumping T1555.003 Credentials from Web Browsers T1102 Web Service T1199 Trusted Relationship T1078.001 Default Accounts T1552.004 Private Keys T1102.001 Dead Drop Resolver

Reporting

Research mentioning ChainDrop

Aug 5

Elastic Security Labs

Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages - Elastic Security Labs

Attackers behind Shai-Hulud compromised the maintainer of the widely used npm library keyv and used a self-propagating worm dubbed CHAINDROP to trojanize the keyv monorepo and spread malicious updates across more than 400 npm packages. The campaign abused npm preinstall hooks for code execution, stole developer credentials from infected machines, and automatically republished malicious package versions anywhere stolen npm tokens had write access, including cases where the tokens bypassed 2FA protections. Packages tied to the keyv ecosystem, including flat-cache, cacheable-request, cacheable, and cache-manager, were identified as part of the downstream exposure, raising broad risk across JavaScript build pipelines and dependent applications. The malware expanded beyond package tampering by implanting Claude Code and VS Code execution hooks and harvesting secrets tied to AI tooling, cloud environments, GitHub, Kubernetes, Vault, SSH, and npm accounts. Elastic Security Labs reported that the operators used an Ethereum smart contract with fallback mechanisms to dynamically resolve exfiltration infrastructure, underscoring a more resilient and automated supply-chain tradecraft. Published guidance urged organizations to revoke GitHub and npm tokens, review repositories for suspicious commits attributed to "claude", rotate exposed secrets, enable npm 2FA, and upgrade to npm 12+ as defenders assess the blast radius of one of the largest recent npm ecosystem compromises.

Aug 5

Malware News