As cited
Citation snapshot as of .
threat intel
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
On August 4, 2026, Elastic Security Labs discovered a campaign targeting the keyv npm package maintainer, with attackers embedding a self-propagating worm called CHAINDROP that uses stolen npm credentials to backdoor over 400 additional packages. The worm executes via preinstall hooks and additional trigger points in development environments, downloading and running obfuscated malware that harvests credentials from developer machines, AI tools, cloud providers, and code repositories. The compromise affects packages with hundreds of millions of monthly downloads, creating significant downstream exposure across the npm ecosystem.
Why it matters: Developers and organizations relying on affected npm packages face immediate risk of credential theft and supply-chain compromise; security teams must audit dependencies for the malware indicators (Math_Symbol.js, math_init.js filenames and commits authored by 'claude') and rotate all potentially exposed credentials, particularly npm tokens, cloud provider keys, and AI service credentials.
- Source published
- First seen by Cybersecurity Tracker