Shai-Hulud is back in the npm ecosystem, and this time its reach is unusually broad.

A new self-propagating malware strain called CHAINDROP has backdoored more than 400 packages after attackers compromised the maintainer of the widely used keyv library.

The campaign turns trusted software updates into a route for stealing developer credentials and spreading further.

It can run before installation is complete, then use captured npm access tokens to publish altered versions of every package a victim is allowed to update.

Elastic Security Labs identified the activity on August 4, describing an attack that began with keyv’s monorepo and expanded rapidly.

The affected package set totals more than 1.3 billion monthly downloads, placing developers, build systems, and downstream applications in the exposure path.

Elastic said in a report shared with Cyber Security News (CSN) that the incident also shows how one compromised maintainer account can produce an ecosystem-wide problem.

Readers tracking the earlier Shai-Hulud npm supply-chain attack will recognize the central risk: stolen publishing credentials let malware move through normal release channels.

Shai-Hulud CHAINDROP Worm Backdoors 400+ npm Packages

The attackers inserted a preinstall hook into package.json, a standard npm feature that runs commands before a package finishes installing.

This means a developer may trigger the malicious code simply by installing or updating an affected dependency, with no need to open or import it.

Supply Chain Monitor initial notifications (Source - Elastic) — Supply Chain Monitor initial notifications (Source – Elastic)

Because npm treats this as part of the normal install process, code review may miss the danger when teams accept a routine patch update. The result is quiet execution inside developer workstations and build environments.

Every keyv subpackage contained a dropper that launched the main payload on Linux, macOS, and Windows.

The altered releases used related components in directly compromised packages and in packages reached through worm propagation, giving defenders a way to investigate suspicious releases.

CHAINDROP first collects credentials from developer systems, including npm, GitHub, cloud, Kubernetes, SSH, CI/CD, and AI coding-tool stores.

Once it finds an npm token with package write access and permission to publish without two-factor authentication, it retrieves packages, injects its files, increments versions, and republishes them.

Preinstall hook in package.json (Source - Elastic) — Preinstall hook in package.json (Source – Elastic)

The malware can also alter repositories when it captures a GitHub App token. It adds malicious Claude Code and VS Code configuration files across as many as 50 branches, so opening an infected repository can create another execution route.

The Keyv package compromise details illustrate why repository access and registry access must be treated as connected risks.

Credential Theft and Containment

The payload searches for more than 300 credential patterns, then compresses and encrypts what it finds before sending it to attacker-controlled infrastructure.

Rather than relying on one fixed command server, it looks up its destination through an Ethereum smart contract, allowing the operator to change infrastructure without republishing the malware.

Organizations should avoid adopting new package versions immediately and introduce a soak period before builds use them.

GitHub repo propagation with Shai-Hulud (Source - Elastic) — GitHub repo propagation with Shai-Hulud (Source – Elastic)

That delay can give researchers and maintainers time to identify poisoned releases, as the poisoned Axios package incident also demonstrated.

Teams should investigate machines that installed affected versions, revoke GitHub tokens, and regenerate exposed npm tokens, especially automation tokens that can bypass two-factor authentication.

They should also rotate cloud, Kubernetes, Vault, AI-tool, and CI/CD secrets that may have been present on impacted endpoints.

Maintainers should enable two-factor authentication on npm accounts, remove bypass_2fa capability where it is not essential, and review repositories for unexpected campaign-related commits.

Upgrading to npm 12 or later adds a safeguard because it blocks preinstall hooks by default, a useful defense against the malicious preinstall script abuse seen in recent supply-chain intrusions.

Security teams can use the technical indicators in the table below while checking build logs for node or bun processes linked to the attack.

Any confirmed hit should be treated as a credential compromise, not merely a bad dependency: isolate the endpoint, review package publishing activity, replace secrets, and audit all recent releases for unauthorized changes before restoring normal development work.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	`9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc`	Hash associated with `Math_Symbol.js`; the report states `math_init.js` shares this hash
SHA-256	`fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb`	Hash associated with `setup.mjs`
SHA-256	`54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668`	Hash associated with `setup.mjs`
File name	`Math_Symbol.js`	Payload filename in directly compromised keyv monorepo packages
File name	`math_init.js`	Payload filename in packages compromised through worm propagation
File name	`setup.mjs`	Dropper filename used to execute the payload
File path	`.claude/settings.json`	Malicious Claude Code SessionStart hook location
File path	`.vscode/tasks.json`	Malicious VS Code folderOpen task location
Ethereum contract	`0xE1f2395ee43e45A1556EC6438a88c31B83493103`	C2 resolver used to retrieve the exfiltration endpoint
Domain	`npm-cache[.]com`	C2 server and dead-drop domain
Domain	`awqhnjewqjkl[.]icu`	C2 server and dead-drop domain
Domain	`go.getblock[.]io`	Ethereum RPC provider referenced in hunting guidance
Domain	`eth.llamarpc[.]com`	Ethereum RPC provider referenced in hunting guidance
Git commit author	`claude@users.noreply.github.com`	Author associated with worm-generated commits
Git commit message	`chore: update config`	Commit message associated with worm-generated commits
Signed marker	`thebeautifulmarchoftime`	Marker used during fallback C2 discovery
Repository description	`Shai-Hulud: Here We Go Again`	Description used for fallback GitHub-based data exfiltration

tionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world

The post Shai-Hulud CHAINDROP Worm Backdoors 400+ npm Packages With 1.3 Billion Monthly Downloads appeared first on Cyber Security News.