FlagThis — Daily Cybersecurity Intelligence Briefing

The ChainDrop worm represents a sophisticated evolution of the Shai-Hulud malware, targeting the npm ecosystem through a multi-stage supply chain attack. Unlike traditional package poisoning, ChainDrop achieves stealth by injecting malicious payloads directly into npm tarballs, effectively bypassing source code audits of GitHub repositories. The worm utilizes npm preinstall hooks and exploits developer environments by weaponizing IDE and AI configuration files, specifically .vscode/tasks.json and .claude/settings.json. By compromising over 444 packages—including widely used dependencies like keyv and cache-manager—the malware facilitates credential theft, environment variable exfiltration, and automated self-propagation across developer workstations and CI/CD pipelines.

The "Shai-Hulud" campaign (specifically the "ChainDrop" wave) is a sophisticated supply chain attack targeting the npm ecosystem via hijacked maintainer accounts for widely used packages like keyv and cacheable. Utilizing malicious npm preinstall scripts, the threat actor deploys a self-propagating "Mini Shai-Hulud" worm and an infostealer. The attack leverages OIDC provenance to bypass integrity checks and employs obfuscated JavaScript files, such as math_init.js and Math_Symbol.js, to exfiltrate AWS credentials, GitHub tokens, Kubernetes secrets, and CI/CD environment variables. With over 440 compromised packages and 2 billion monthly downloads at risk, the campaign facilitates deep transitive infection across developer workstations and cloud infrastructure.