Loading malware…
ChainDrop is a cross-platform, self-propagating npm supply-chain worm and credential stealer in the Mini Shai-Hulud/Shai-Hulud code lineage. First identified in August 2026, it spread from compromised npm maintainer publishing access by adding malicious npm preinstall lifecycle scripts to legitimate packages and republishing modified patch versions. The campaign affected hundreds of npm packages, including packages in the Keyv ecosystem, while preserving their legitimate functionality to reduce suspicion. ChainDrop executes during dependency installation on developer workstations and CI/CD runners, using a dropper to obtain a JavaScript runtime and launch a heavily obfuscated payload on Linux, macOS, and Windows. It harvests npm and GitHub credentials, cloud credentials, SSH material, Kubernetes and HashiCorp Vault data, environment files, AI development-tool data, and secrets available in GitHub Actions runner memory. Collected data is compressed, encrypted, and exfiltrated to attacker-controlled infrastructure, with public repositories created through compromised GitHub accounts available as a fallback channel. The worm validates stolen publishing credentials, enumerates packages that the compromised identity can update, injects its components and installation hook, increments package versions, and republishes them, enabling rapid propagation across unrelated maintainers and organizations. It can also modify accessible source repositories and implant project-level execution hooks for VS Code and Claude Code, allowing reinfection when a developer opens a workspace or begins an AI coding session. ChainDrop dynamically resolves command-and-control and exfiltration infrastructure through an Ethereum smart contract, providing resilience against static domain blocking. The malware is clearly derived from Shai-Hulud-related code, but attribution to TeamPCP is not confirmed.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
On August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP.
The attackers trojanized the monorepo and embedded a self-propagating worm called CHAINDROP that uses stolen npm credentials to automatically backdoor every other package the maintainer had publish rights to.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
The worm component activates when the credential sweep turns up an npm token... Once a qualifying token is found, the worm enumerates every package the victim has publish rights to.
If it finds any, it queries the GitHub API to list all accessible repositories and branches
Rather than just hunting for bugs in finished software, attackers are targeting the everyday tools and code developers rely on. Unit 42 research shows this happening at every step of the building process.
Execution: Used a preinstall hook to download the Bun runtime and execute the obfuscated Math_Symbol.js payload. | Downloads the Bun JavaScript runtime v1.3.13 directly from its official GitHub release page. Launches the second-stage payload via Bun.
a hidden Python script directly read live process memory from GitHub Actions runners
Execution is triggered via a preinstall hook in package.json. This abuses a legitimate npm feature that will run arbitrary commands before a package is installed.
Even if you never install an infected package (“ npm install ” in npm argot), you can still get the nasties – though that is one possible route of infection.
The worm component activates when the credential sweep turns up an npm token... Once a qualifying token is found, the worm enumerates every package the victim has publish rights to.
a hidden Python script directly read live process memory from GitHub Actions runners to steal temporary OpenID Connect (OIDC) tokens and secrets
The worm component activates when the credential sweep turns up an npm token... Once a qualifying token is found, the worm enumerates every package the victim has publish rights to.
The payload is heavily obfuscated at 711 kilobytes, employing control-flow flattening with a string encoding scheme using Base91.
a hidden Python script directly read live process memory from GitHub Actions runners to steal temporary OpenID Connect (OIDC) tokens and secrets
After execution, the bun temporary directory is deleted to cover its tracks.
The worm component activates when the credential sweep turns up an npm token... Once a qualifying token is found, the worm enumerates every package the victim has publish rights to.
If it finds any, it queries the GitHub API to list all accessible repositories and branches
It looks in shell configurations, environment variables and even live memory.
When executed, the software scours the user’s workspace for npm tokens with full write privileges
Its collector scanned for more than 300 credential patterns, including OpenAI, Anthropic and Cursor keys.
It looks in shell configurations, environment variables and even live memory.
It looks in shell configurations, environment variables and even live memory.
The payload has a component called collector that functions as a credential harvester... Many other credentials are targeted, such as GitHub ... SSH private keys, Kubernetes service account tokens, and npm tokens.
The malware also targets cloud provider credentials from AWS, GCP, Azure, and Alibaba Cloud.
ChainDrop fans out across three RPC providers ( eth.llamarpc.com , go.getblock.io , eth-mainnet.nodereal.io ), so a rate-limited or downed endpoint does not break resolution.
Even its command infrastructure was parked inside an Ethereum smart contract, rendering any domain blocklists moot.
If these two previous paths fail, CHAINDROP will exfiltrate the data via a public GitHub repository ... using the compromised victim's account.
The dropper will detect the platform/architecture of the machine and download bun v1.3.13 directly from the official release page. It will extract bun, then use it to execute the payload.
The ABI-decoded response holds the C2 pointer. Operators pick the encoding: a plain UTF-8 URL, Base64, Base64 plus XOR, gzip plus Base64, or a bash one-liner.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A supply-chain worm variant that compromised package releases through legitimate signed maintainer pipelines, resulting in poisoned packages with valid SLSA provenance attestations. Its command infrastructure was hosted through an Ethereum smart contract to resist conventional domain-based blocking.
A self-propagating npm worm that abuses malicious preinstall scripts to launch an obfuscated payload, steal GitHub Actions OIDC tokens and local developer credentials, backdoor developer tools for persistence, and republish additional packages using stolen npm and GitHub tokens.
npm supply-chain malware that compromised over 440 npm packages and used an Ethereum eth_call dead drop resolver to obtain its exfiltration/C2 destination from a smart contract, with fallback across multiple RPC providers.
A self-propagating npm worm that compromises trusted software release pipelines, steals developer and cloud credentials, republishes infected packages using stolen npm tokens, persists via IDE and AI-tooling hooks, uses Ethereum-based C2 retrieval, and can trigger destructive wiping behavior when stolen tokens are revoked.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.