Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.
On August 4, 2026, the self-propagating ChainDrop worm entered the npm ecosystem through a compromised maintainer account, poisoning packages including keyv, cacheable, and flat-cache. ChainDrop is a variant of Mini Shai-Hulud linked to the actor TeamPCP. It anchors its C2 infrastructure in an Ethereum smart contract, allowing domain rotation with a single blockchain transaction and defeating domain-based blocklists. The compromised keyv maintainer's GitHub account caused the project's own GitHub Actions release pipeline to publish malicious package versions.
- Spread via compromised GitHub account of the keyv maintainer
- Poisoned packages include keyv, cacheable, and flat-cache
- C2 domains rotate through an Ethereum smart contract
- Linked to Mini Shai-Hulud and the TeamPCP actor
- GitHub Actions release pipeline published the malicious versions
- Products
- keyvcacheableflat-cache
- Threat actors
- TeamPCP
- Organizations
- Zscaler ThreatLabz
From the original article
IntroductionOn August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a single blockchain transaction and rendering domain-based blocklists ineffective.
By Manisha Ramcharan Prajapati (Sr. Security Researcher) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.