A new supply chain attack dubbed ChainDrop has infected more than 440 NPM packages, publishing over 2,200 malicious versions in a rapid, self-propagating campaign researchers are calling a Mini Shai-Hulud variant. The incident began with 11 malware carriers seeded into the popular keyv and cacheable namespaces after the maintainer’s GitHub account was compromised.

Because keyv and cacheable are widely used dependencies with a combined 500 million weekly downloads, the initial poisoning cascaded into 433 additional infected packages. According to StepSecurity, the worm’s rapid republishing pushed the total number of malicious package iterations to 2,212 within under four hours on August 4.

Every infected version carries a preinstall dropper that fetches the legitimate Bun JavaScript runtime alongside roughly 710 KB of obfuscated second-stage code, the actual payload. Once executed, the malware scans developer workstations and CI/CD environments for NPM, GitHub, cloud, and infrastructure credentials, according to Microsoft. It uses harvested identities to authenticate to NPM, GitHub, AWS, Kubernetes, and HashiCorp Vault, enumerating repositories, workflow secrets, and cloud parameters before encrypting and exfiltrating the data.

Exfiltration occurs either to a dynamic HTTPS endpoint or to attacker-created public GitHub repositories bearing a ‘Shai-Hulud: Here We Go Again’ description. JFrog notes the malware uses stolen NPM tokens to automatically tamper with and republish every package it can reach, incrementing patch versions and inserting a preinstall hook, while compromised GitHub credentials and Actions are used to infect further repositories.

Microsoft also observed the malware injecting Claude and Visual Studio Code configuration files into repositories to establish persistence and create an additional developer-to-developer infection path. The worm is described as an evolved descendant of Shai-Hulud 2.0, using an Ethereum blockchain for command-and-control via a technique known as EtherHiding. Socket reports it also installs a dead-man’s switch on macOS and Linux hosts, polling the GitHub API every 60 seconds with the victim’s stolen token and self-destructing if the token is revoked or after 24 hours.

Recommended Actions

Organizations that installed any affected package version should treat impacted machines as fully compromised. Recommended steps include:

  • Isolating affected systems immediately
  • Preserving package tarballs, NPM logs, CI logs, GitHub audit logs, and runner images for investigation
  • Rebuilding CI runners and build machines
  • Revoking and rotating all potentially exposed credentials
  • Auditing GitHub repositories for anomalous commits or workflow activity