Shai-Hulud is back in the npm ecosystem, and this time its reach is unusually broad.
A new self-propagating malware strain called CHAINDROP has backdoored more than 400 packages after attackers compromised the maintainer of the widely used keyv library.
The campaign turns trusted software updates into a route for stealing developer credentials and spreading further.
It can run before installation is complete, then use captured npm access tokens to publish altered versions of every package a victim is allowed to update.
Elastic Security Labs identified the activity on August 4, describing an attack that began with keyv’s monorepo and expanded rapidly.
The affected package set totals more than 1.3 billion monthly downloads, placing developers, build systems, and downstream applications in the exposure path.
Elastic said in a report shared with Cyber Security News (CSN) that the incident also shows how one compromised maintainer account can produce an ecosystem-wide problem.
Readers tracking the earlier Shai-Hulud npm supply-chain attack will recognize the central risk: stolen publishing credentials let malware move through normal release channels.
Shai-Hulud CHAINDROP Worm Backdoors 400+ npm Packages
The attackers inserted a preinstall hook into package.json, a standard npm feature that runs commands before a package finishes installing.
This means a developer may trigger the malicious code simply by installing or updating an affected dependency, with no need to open or import it.
Supply Chain Monitor initial notifications (Source – Elastic)
Because npm treats this as part of the normal install process, code review may miss the danger when teams accept a routine patch update. The result is quiet execution inside developer workstations and build environments.
Every keyv subpackage contained a dropper that launched the main payload on Linux, macOS, and Windows.
The altered releases used related components in directly compromised packages and in packages reached through worm propagation, giving defenders a way to investigate suspicious releases.
CHAINDROP first collects credentials from developer systems, including npm, GitHub, cloud, Kubernetes, SSH, CI/CD, and AI coding-tool stores.
Once it finds an npm token with package write access and permission to publish without two-factor authentication, it retrieves packages, injects its files, increments versions, and republishes them.
Preinstall hook in package.json (Source – Elastic)
The malware can also alter repositories when it captures a GitHub App token. It adds malicious Claude Code and VS Code configuration files across as many as 50 branches, so opening an infected repository can create another execution route.
The Keyv package compromise details illustrate why repository access and registry access must be treated as connected risks.
Credential Theft and Containment
The payload searches for more than 300 credential patterns, then compresses and encrypts what it finds before sending it to attacker-controlled infrastructure.
Rather than relying on one fixed command server, it looks up its destination through an Ethereum smart contract, allowing the operator to change infrastructure without republishing the malware.
Organizations should avoid adopting new package versions immediately and introduce a soak period before builds use them.
GitHub repo propagation with Shai-Hulud (Source – Elastic)
That delay can give researchers and maintainers time to identify poisoned releases, as the poisoned Axios package incident also demonstrated.
Teams should investigate machines that installed affected versions, revoke GitHub tokens, and regenerate exposed npm tokens, especially automation tokens that can bypass two-factor authentication.
They should also rotate cloud, Kubernetes, Vault, AI-tool, and CI/CD secrets that may have been present on impacted endpoints.
Maintainers should enable two-factor authentication on npm accounts, remove bypass_2fa capability where it is not essential, and review repositories for unexpected campaign-related commits.
Upgrading to npm 12 or later adds a safeguard because it blocks preinstall hooks by default, a useful defense against the malicious preinstall script abuse seen in recent supply-chain intrusions.
Security teams can use the technical indicators in the table below while checking build logs for node or bun processes linked to the attack.
Any confirmed hit should be treated as a credential compromise, not merely a bad dependency: isolate the endpoint, review package publishing activity, replace secrets, and audit all recent releases for unauthorized changes before restoring normal development work.
Indicators of Compromise (IoCs):-
TypeIndicatorDescriptionSHA-2569fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bccHash associated with Math_Symbol.js; the report states math_init.js shares this hashSHA-256fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1ebHash associated with setup.mjsSHA-25654dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668Hash associated with setup.mjsFile nameMath_Symbol.jsPayload filename in directly compromised keyv monorepo packagesFile namemath_init.jsPayload filename in packages compromised through worm propagationFile namesetup.mjsDropper filename used to execute the payloadFile path.claude/settings.jsonMalicious Claude Code SessionStart hook locationFile path.vscode/tasks.jsonMalicious VS Code folderOpen task locationEthereum contract0xE1f2395ee43e45A1556EC6438a88c31B83493103C2 resolver used to retrieve the exfiltration endpointDomainnpm-cache[.]comC2 server and dead-drop domainDomainawqhnjewqjkl[.]icuC2 server and dead-drop domainDomaingo.getblock[.]ioEthereum RPC provider referenced in hunting guidanceDomaineth.llamarpc[.]comEthereum RPC provider referenced in hunting guidanceGit commit authorclaude@users.noreply.github.comAuthor associated with worm-generated commitsGit commit messagechore: update configCommit message associated with worm-generated commitsSigned markerthebeautifulmarchoftimeMarker used during fallback C2 discoveryRepository descriptionShai-Hulud: Here We Go AgainDescription used for fallback GitHub-based data exfiltration
tionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
The post Shai-Hulud CHAINDROP Worm Backdoors 400+ npm Packages With 1.3 Billion Monthly Downloads appeared first on Cyber Security News.
