A new strain of the Shai-Hulud npm worm tore through the JavaScript package ecosystem on August 4, 2026, poisoning 444 packages in a matter of hours and hijacking the very tools developers trust to write and review code. Security researchers at Microsoft, JFrog, Socket, and StepSecurity independently tracked the outbreak in real time, and what they found was not a routine dependency hijack. The malware, dubbed ChainDrop, spreads through tarballs instead of visible source commits, plants itself in editor configuration files for VS Code and Claude Code, and uses an Ethereum-based command channel to stay resilient even after its packages get pulled.
By the time engineering teams finished their morning coffee, StepSecurity had already logged 2,212 malicious package iterations published in under four hours, according to reporting by SecurityWeek. The infected packages, led by the widely used keyv and cacheable libraries, carry a combined weekly download count north of 500 million. This is not a story about one careless maintainer. It is a story about how a nine-month-old malware family has learned to weaponize the exact developer tools — AI coding assistants, CI/CD pipelines, GitHub Actions — that the industry adopted to move faster.
What Happened: The ChainDrop npm Supply Chain Attack
The attack began when a maintainer account tied to the keyv and cacheable npm namespaces was compromised, giving attackers a publishing token with broad reach across the dependency tree. From there, the malware behaved like a worm rather than a one-off trojan. Once it landed on a developer machine or a CI runner, it searched for every npm token, GitHub credential, cloud key, and secret it could find, according to Microsoft’s security blog, which published a technical breakdown of the compromise on the same day it was discovered.
Microsoft’s analysis describes a credential-harvesting routine that authenticates to npm, GitHub, AWS, Kubernetes, and HashiCorp Vault using whatever identity it manages to steal, then enumerates every package, repository, workflow secret, and cloud parameter reachable from that identity. Once it has an npm publishing token, it downloads the latest tarball of every package the token can touch, injects its own preinstall hook and loader, bumps the patch version, and republishes — all without leaving a trace in the source repository itself, since the tampering lives in the packaged tarball rather than in a commit anyone would review.
That detail matters more than it might sound. The Register’s coverage notes that scanning the code repository for evidence of tampering will not turn anything up, because ChainDrop rebuilds and republishes the distributed tarball directly rather than committing malicious code to the branch history. Security teams who rely on source-level code review or repository diffing as their main defense have a blind spot exactly where ChainDrop operates.
The IDE Infection Path: Claude Code and VS Code as Attack Vectors
The most novel part of ChainDrop’s design is a second infection path that does not require anyone to run npm install at all. When the malware steals GitHub credentials, it queries the GitHub API for every repository and branch the compromised identity can reach, then commits malicious configuration code directly into those branches, per The Register’s reporting. Specifically, it drops files resembling .claude/settings.json and .vscode/tasks.json that trigger a background task the moment another developer opens that branch in VS Code or Claude Code.
That means a developer who never touches the infected package directly can still get compromised simply by opening a colleague’s branch in their editor. Abby Kearns, CEO of the open-source security firm ActiveState, flagged this as the defining feature of the campaign in a Medium post cited by The Register, arguing that dependency scanning tools were never configured to look inside editor and task-runner configuration files, because nobody treated those files as executable attack surface until now. Her recommended first response step is blunt: check every branch, not just main, for unauthorized .claude/settings.json or .vscode/tasks.json files, since ChainDrop does not confine itself to the default branch.
Once triggered, the background task restarts the credential-harvesting cycle on the newly infected machine, which is what gives ChainDrop its worm-like, self-sustaining spread across a team or an organization rather than a single compromised build.
Inside the Payload: Bun Runtime, EtherHiding, and a Dead Man’s Switch
Every infected package version shipped with a preinstall dropper that quietly pulls down the legitimate Bun JavaScript runtime, then loads roughly 710 KB of obfuscated second-stage code alongside it, according to SecurityWeek’s account of JFrog’s findings. Using a real, signed runtime as a delivery mechanism is a deliberate choice: it blends the malicious payload’s execution into what looks like a normal build step rather than an obviously suspicious binary.
For command and control, ChainDrop is described as an evolved descendant of the earlier Shai-Hulud 2.0 worm that communicates over the Ethereum blockchain, a technique known as EtherHiding. Routing instructions through blockchain transactions makes the command channel far harder to take down than a conventional server, since there is no single domain or IP address for defenders to sinkhole.
The malware also builds in its own self-destruction logic. Once it has persistence on a macOS or Linux host, it polls the GitHub API every 60 seconds using the victim’s stolen token, according to research from Socket cited by SecurityWeek. If that token stops working — because it was revoked, for instance — the malware treats that as a signal to wipe its own state and exit. It also self-clears after 24 hours regardless of token status, which limits its own footprint on any single machine while still giving it a wide window to steal and republish before disappearing.
Why This Isn’t an Isolated Incident: The Shai-Hulud Timeline
ChainDrop is not a new malware family so much as the latest and most capable release from a lineage that has been active for nearly a year. The name Shai-Hulud comes from the giant sandworms in Frank Herbert’s novel Dune, a reference researchers gave the malware when a self-replicating, worm-like package compromise first appeared in the npm ecosystem in September 2025, per The Register. Since then, the family has gone through several documented waves rather than a single event.
Intel 471’s research, published July 31, 2026, tracks Shai-Hulud, a related “Mini Shai-Hulud” variant, and an associated tool called Miasma operating continuously between September 2025 and June 2026 — nine months of sustained campaign activity before ChainDrop’s August escalation. A separate FBI-linked advisory from July 2026 ties tools called CanisterWorm and SANDCLOCK to a group tracked as TeamPCP, describing malware built to collect cloud access tokens, API keys, AWS credentials, Kubernetes ServiceAccount tokens, local environment variables, and cryptocurrency wallet data. That advisory specifically notes that Mini Shai-Hulud operates as a self-replicating worm across both npm and PyPI, meaning the threat already extends beyond the JavaScript ecosystem into Python’s package registry.
The Cyber Security Agency of Singapore issued an advisory on August 6, 2026 describing ChainDrop as an active, ongoing supply chain campaign rather than a closed incident, and GitGuardian’s research from early August found that a Shai-Hulud infostealer variant now scans 469 distinct credential storage locations across developer environments, CI/CD tooling, cloud configuration files, and AI tool configurations — up from 189 locations in earlier variants, according to a follow-up report from The Hacker News. Nine months is a long time for a worm family to keep evolving against the same ecosystem’s defenses, and the trend line points toward more capable variants rather than fewer. It also lines up with a broader pattern of critical-infrastructure-adjacent targets this security desk has tracked this year, from CISA’s warnings about Iranian state-linked hackers probing US infrastructure sectors to the growing backlog of flaws landing on the CISA Known Exploited Vulnerabilities catalog.
Historical Context: npm’s Long History of Supply Chain Trouble
Open-source package registries have been a soft target for years, and ChainDrop fits a pattern rather than breaking new ground on the “why.” The 2018 event-stream incident, in which an attacker gained publishing rights to a popular npm package specifically to target a Bitcoin wallet application downstream, was an early warning that transitive dependencies could be weaponized at scale. The 2021 ua-parser-js compromise showed the same trick could hit a package with millions of weekly downloads and no obvious high-value target, just broad reach. The 2024 discovery of a backdoor planted in xz-utils, a compression library embedded deep in the Linux ecosystem, demonstrated that attackers are willing to spend years building maintainer trust before striking.
What separates ChainDrop from that history is automation and speed. Earlier supply chain compromises typically involved a human attacker manually publishing a poisoned version and waiting. ChainDrop is a self-propagating worm that used stolen credentials to republish poisoned versions of 433 additional packages on its own, according to SecurityWeek, turning a single compromised maintainer account into a cascading, self-sustaining outbreak within the same day. CrowdStrike’s 2026 Threat Hunting Report, published September 2, 2026, frames this shift explicitly: in the first half of 2026, the report found that supply chain attacks increasingly relied on malicious packages uploaded to public registries like npm and PyPI, which have become primary delivery channels rather than a secondary vector.
Market Impact: What ChainDrop Costs the Software Industry
The direct exposure numbers alone are significant. Packages caught up in the ChainDrop wave carry a combined download count of more than 500 million per week, per SecurityWeek’s reporting, while The Register cites researchers estimating that the initial batch of infected packages — including keyv, flat-cache, and cache-manager — are collectively pulled roughly 2 billion times a month. Those are dependency-tree numbers, not infection numbers; not every download resulted in a compromised machine. But they illustrate how much of the JavaScript ecosystem sits downstream of a small number of infrastructure packages that most developers never think about.
The remediation cost is where the real bill lands. JFrog’s guidance, relayed by SecurityWeek, tells affected organizations to isolate compromised systems and preserve package tarballs, npm logs, CI logs, GitHub audit logs, and runner images before doing any cleanup, because that evidence is what bounds the actual exposure window. Beyond forensics, the standard remediation checklist includes removing the malware, rebuilding CI runners and build machines from scratch, revoking and rotating every potentially exposed credential, and auditing GitHub repositories for anomalous commits across all branches. For any mid-size engineering organization, that is days of infrastructure work layered on top of the security investigation itself, and it has to happen before anyone can trust their build pipeline again.
There is also a slower-moving cost: trust. Every wave of Shai-Hulud-family attacks chips away at the assumption that a popular, widely-downloaded npm package is inherently safer than an obscure one. Security teams that used download counts or GitHub star counts as an informal trust signal are being forced to abandon that heuristic, since ChainDrop specifically targeted infrastructure-tier packages precisely because of their reach.
Timeline of the Shai-Hulud Malware Family
| Date / Period | Development | Source |
|---|---|---|
| September 2025 | First Shai-Hulud self-replicating npm worm identified and named after Dune’s sandworms | The Register |
| September 2025 – June 2026 | Shai-Hulud, Mini Shai-Hulud, and the Miasma tool operate continuously across multiple campaign waves | Intel 471 |
| July 2026 | FBI-linked advisory ties CanisterWorm and SANDCLOCK tools to group “TeamPCP”; confirms Mini Shai-Hulud spreads across both npm and PyPI | FBI advisory |
| Early August 2026 | Shai-Hulud infostealer variant found scanning 469 distinct credential storage locations | GitGuardian |
| August 4, 2026 | ChainDrop variant infects 444 packages; 2,212 malicious package versions published in under 4 hours | SecurityWeek / StepSecurity |
| August 6, 2026 | Cyber Security Agency of Singapore issues advisory describing ChainDrop as an active, ongoing campaign | CSA Singapore |
| September 2, 2026 | CrowdStrike’s 2026 Threat Hunting Report names public registry attacks as a defining H1 2026 trend | CrowdStrike |
Competitive Comparison: How Security Vendors Are Responding
ChainDrop’s speed and its unconventional editor-configuration infection path forced multiple security vendors to publish independent analyses within days of each other, and their focus areas diverge in a way that’s useful for buyers to understand. Microsoft’s write-up leans into the credential-harvesting and cross-service authentication mechanics — npm, GitHub, AWS, Kubernetes, HashiCorp Vault — treating ChainDrop as an identity problem as much as a malware problem. JFrog’s angle, filtered through SecurityWeek, is registry-centric: tracking exactly how many malicious package versions got published and how fast. StepSecurity and Socket both focus on the CI/CD and runtime detection layer, tracking the preinstall hooks and the dead-man’s-switch behavior in real time. GitGuardian’s contribution is breadth — cataloguing the sheer number of places the malware now knows to look for secrets.
| Vendor / Researcher | Primary Focus on ChainDrop | Key Finding |
|---|---|---|
| Microsoft | Credential harvesting, cross-service authentication | Malware authenticates to npm, GitHub, AWS, Kubernetes, and HashiCorp Vault using stolen identities |
| JFrog (via SecurityWeek) | Registry-level package tracking | 2,200+ malicious versions across 440 packages; 433 additional packages infected downstream |
| StepSecurity | CI/CD and publish-rate monitoring | 2,212 malicious package iterations observed within 4 hours on August 4 |
| Socket | Runtime and persistence behavior | Identified the 60-second GitHub token polling dead-man’s switch and 24-hour self-clear |
| GitGuardian | Credential exposure surface | Documented 469 distinct locations the malware scans for secrets |
| ActiveState | Developer workflow and editor risk | Flagged unauthorized .claude/settings.json and .vscode/tasks.json files as the infection tell |
Why AI Coding Assistants Widened the Attack Surface
ChainDrop’s decision to target Claude Code and VS Code configuration files specifically is not incidental. As AI coding assistants have become standard tooling on developer machines over the past two years, they’ve also become a background process that runs automatically whenever a project folder is opened, often with elevated trust and broad filesystem access to make suggestions or execute tasks. That combination — automatic execution plus broad access — is exactly what a credential-harvesting worm wants, and it’s a substantially newer attack surface than the CI/CD pipelines and package registries that supply chain security tooling has spent the last several years hardening.
It also means that traditional dependency scanning, which checks what a project declares as a dependency, misses this entirely. A `.vscode/tasks.json` file is configuration, not a dependency declaration, so most software composition analysis tools were never pointed at it. That gap is precisely what ActiveState’s Kearns described as the defining discovery of this campaign, and it is likely to reshape what dependency and secret scanning tools check by default going forward.
What Developers and Security Teams Should Do Now
The immediate guidance from researchers tracking ChainDrop is consistent across sources. Anyone who installed one of the affected package versions should treat the machine as compromised rather than attempt a partial cleanup. The open-source security firm SafeDep maintains a list of the specific compromised packages and version numbers, which is the first thing to check against a project’s lockfile.
From there, the recommended sequence is: remove the malware from any affected machine, rebuild CI runners and build machines from a known-clean image rather than patching in place, revoke and rotate every credential that touched the machine (npm tokens, GitHub personal access tokens, cloud keys, Vault secrets), and audit repositories — across every branch, not just the default one — for unauthorized commits or configuration files. JFrog’s specific advice is to preserve tarballs, npm logs, CI logs, GitHub audit logs, and runner images before any cleanup begins, since that evidence is what lets a team bound how far the exposure actually spread rather than guessing.
The pattern of attackers targeting CI/CD credentials and cloud keys tracks with other incidents this site has covered, including a separate MLflow flaw that let attackers steal cloud keys via SSRF and an authentication bypass bug in JFrog Artifactory itself, the same platform whose researchers first sized up the ChainDrop outbreak.
Code Example: Checking for ChainDrop Indicators
Security teams triaging potential exposure can start with a repository-wide search for the configuration files ChainDrop is known to plant, checked across every branch rather than just the default one.
\# List all branches and search each for suspicious config files
git for-each-ref --format='%(refname:short)' refs/heads/ refs/remotes/ | \
while read branch; do
git show "$branch":.claude/settings.json 2>/dev/null && echo "FOUND in $branch"
git show "$branch":.vscode/tasks.json 2>/dev/null | grep -qi "preinstall\|bun\|curl" && echo "SUSPICIOUS tasks.json in $branch"
done
\# Check installed package.json for known-affected libraries
grep -E '"(keyv|cacheable|flat-cache|cache-manager)"' package.json package-lock.jsonThis is a starting triage step, not a substitute for the full credential rotation and CI rebuild that JFrog and Microsoft both recommend once exposure is confirmed.
Predictions: Where npm Supply Chain Security Goes Next
A few trajectories look likely given how ChainDrop and its predecessors have evolved over the past nine months.
First, expect more worm variants that specifically target AI coding assistant configuration files rather than treating them as an afterthought. ChainDrop proved the technique works at scale, and copycat campaigns targeting Claude Code, VS Code, Cursor, and similar tools are a reasonable near-term expectation.
Second, package registries will likely accelerate mandatory provenance and trusted-publishing requirements. npm and PyPI have both discussed short-lived, scoped publishing tokens tied to CI identity rather than long-lived personal tokens; incidents like ChainDrop, where a single stolen token republished hundreds of packages, make the case for that shift more urgent.
Third, CI/CD teams will move toward ephemeral, single-use build runners as a default rather than an optional hardening step, specifically to blunt the value of a stolen CI credential before it can be reused.
Fourth, blockchain-based command and control, as seen with ChainDrop’s use of EtherHiding, is likely to spread to other malware families given how difficult it makes takedown efforts, pushing security vendors to build dedicated on-chain C2 detection.
Fifth, expect more government advisories in the mold of Singapore’s CSA notice and the FBI’s TeamPCP guidance, as national cybersecurity agencies treat open-source package registry compromises as critical infrastructure risk rather than a developer-tooling niche issue.
The Broader Pattern: Registries as Critical Infrastructure
What ChainDrop really exposes is a mismatch between how npm and PyPI are used and how they’re defended. These registries function as critical infrastructure for the modern software industry, since a huge share of production applications pull in dozens or hundreds of transitive dependencies without any human reviewing each one. But the registries themselves, and the maintainer accounts that publish to them, are frequently secured with the same single-factor, long-lived credentials an individual hobbyist project might use. CrowdStrike’s framing of registry-based attacks as a defining H1 2026 trend, rather than an isolated incident, suggests the industry is only beginning to reckon with that mismatch.
The FBI advisory’s confirmation that Mini Shai-Hulud already operates across both npm and PyPI is the detail worth sitting with longest. A malware family that started in one package ecosystem in September 2025 has, within a year, become cross-ecosystem, cross-platform, and capable of using developer tooling itself as a propagation vector. That trajectory argues against treating ChainDrop as a contained incident and for treating it as the current high-water mark of a threat that is still rising, not unlike how a single unpatched flaw, such as the PaperCut zero-days added to the CISA KEV catalog, tends to keep resurfacing in new campaigns long after the initial disclosure.
Frequently Asked Questions
What is ChainDrop?
ChainDrop is the name Microsoft and other researchers gave to the npm supply chain worm variant that infected 444 packages starting August 4, 2026. It is the latest variant in the Shai-Hulud malware family, first identified in September 2025.
Which npm packages were affected by ChainDrop?
The outbreak began with the keyv and cacheable namespaces after a maintainer’s GitHub account was compromised, then spread to include flat-cache, cache-manager, and hundreds of additional packages as the worm republished poisoned versions using stolen npm tokens.
How does ChainDrop spread without installing an infected package?
ChainDrop can also spread by committing malicious .claude/settings.json or .vscode/tasks.json configuration files directly into GitHub repository branches using stolen credentials. Opening an infected branch in VS Code or Claude Code can trigger a background task that harvests credentials, even if the developer never runs npm install.
What credentials does the ChainDrop malware target?
According to Microsoft’s analysis, it targets npm publishing tokens, GitHub credentials, AWS keys, Kubernetes ServiceAccount tokens, and HashiCorp Vault secrets, along with shell configuration files, environment variables, and live memory.
How do I check if my project was affected by ChainDrop?
Check your package.json and lockfiles against the compromised package list maintained by SafeDep, search all git branches (not just main) for unauthorized .claude/settings.json or .vscode/tasks.json files, and treat any machine that installed a flagged version as compromised rather than attempting a partial cleanup.
Is ChainDrop related to Shai-Hulud?
Yes. ChainDrop is described by Microsoft and other researchers as an evolved descendant of the Shai-Hulud 2.0 worm, part of a malware lineage that has been active continuously since September 2025, according to Intel 471’s research.
What should organizations do if they find compromised packages?
JFrog recommends isolating affected systems and preserving package tarballs, npm logs, CI logs, GitHub audit logs, and runner images before cleanup. Follow-up steps include rebuilding CI runners from clean images, rotating all potentially exposed credentials, and auditing repositories across all branches for anomalous activity.
Does ChainDrop affect ecosystems beyond npm?
The core ChainDrop outbreak targeted npm specifically, but a related tool in the same malware family, Mini Shai-Hulud, has been confirmed by an FBI-linked advisory to operate as a self-replicating worm across both npm and PyPI, indicating the broader threat is not limited to JavaScript.
