Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.
On August 4, 2026, the self-propagating ChainDrop worm entered the npm ecosystem through a compromised maintainer account, poisoning packages including keyv, cacheable, and flat-cache. ChainDrop is a variant of Mini Shai-Hulud linked to the actor TeamPCP. It anchors its C2 infrastructure in an Ethereum smart contract, allowing domain rotation with a single blockchain transaction and defeating domain-based blocklists. The compromised keyv maintainer's GitHub account caused the project's own GitHub Actions release pipeline to publish malicious package versions.
- Spread via compromised GitHub account of the keyv maintainer
- Poisoned packages include keyv, cacheable, and flat-cache
- C2 domains rotate through an Ethereum smart contract
- Linked to Mini Shai-Hulud and the TeamPCP actor
- GitHub Actions release pipeline published the malicious versions
IntroductionOn August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a single blockchain transaction and rendering domain-based blocklists ineffective.The attacker compromised the GitHub account of the maintainer of the keyv ecosystem, injecting malicious code into the source repository. This caused the project's own GitHub Actions-based release pipeline to build and publish poisoned versions of packages including keyv, cacheable, flat-cache, and…
This source does not provide full text. Read it at zscaler.com.