[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fL-2j0FS1jDJAHYnPUpU5EgKAHc7IwN7h26aVjvrzQ0E":3,"$f_SH6Y-NIevzIv8HEDxfj7gssT1AlgMQZkZ6RKGx3UoA":91},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":88,"created_at":89,"updated_at":90,"published_at":50},"palo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa","ChainDrop: Self-Propagating npm Worm Compromises 400+ Packages Starting From keyv","Elastic Security Labs and Microsoft detail a Shai-Hulud-style worm that steals npm and GitHub tokens, republishes packages with a preinstall hook and resolves its C2 through an Ethereum contract.","Elastic Security Labs and Microsoft have published analyses of ChainDrop, a self-propagating npm worm that Elastic identified on 4 August 2026 and that compromised more than 400 packages, starting with the trojanised keyv monorepo. Unit 42 later cited it as an example of SDLC supply-chain risk.",[10,11,12,13,14],"ChainDrop","npm","supply-chain","Shai-Hulud","Ethereum C2","# ChainDrop: Self-Propagating npm Worm Compromises 400+ Packages Starting From keyv\n\n*Elastic Security Labs and Microsoft detail a Shai-Hulud-style worm that steals npm and GitHub tokens, republishes packages with a preinstall hook and resolves its C2 through an Ethereum contract.*\n\n**Tags:** `ChainDrop` `npm` `supply-chain` `Shai-Hulud` `Ethereum C2`\n\n> Elastic Security Labs and Microsoft have published analyses of ChainDrop, a self-propagating npm worm that Elastic identified on 4 August 2026 and that compromised more than 400 packages, starting with the trojanised keyv monorepo. Unit 42 later cited it as an example of SDLC supply-chain risk.\n\n---\n\n## ChainDrop: a self-propagating npm worm\n\nElastic Security Labs identified a new Shai-Hulud campaign on 4 August 2026 and named the worm CHAINDROP. By the time of Elastic's write-up, more than 400 unique npm packages had been compromised. Microsoft published its own analysis the same week, describing the malware as a \"Mini Shai-Hulud variant\". Neither Elastic nor Microsoft attributes the campaign to a named threat actor.\n\nThe campaign began with `keyv`, a key-value storage library with over 600 million downloads in the previous month according to Elastic. The attackers trojanised the keyv monorepo, backdooring every subpackage. Elastic says the co-owned backdoored packages together account for over 1.3 billion monthly downloads, and Microsoft names keyv, flat-cache and cache-manager among the affected packages. Microsoft notes that many malicious versions had no matching source commit, pull request or tag, indicating the tarballs were modified and published directly.\n\n## How the worm works\n\nMalicious releases add a `preinstall` lifecycle hook to `package.json` that runs a dropper, `setup.mjs`, during installation with no further user action. If the Bun runtime is not present, the dropper downloads it from Bun's official GitHub releases and uses it to run an obfuscated JavaScript payload (`Math_Symbol.js`, or `math_init.js` in worm-propagated packages). Microsoft reports that the payload exits on Russian-language systems and stays attached in CI\u002FCD runs to reach job secrets and OIDC publishing permissions.\n\nThe credential collector looks for npm and GitHub tokens, cloud credentials (AWS, GCP, Azure, Alibaba Cloud), HashiCorp Vault and Kubernetes tokens, SSH keys and AI tooling credentials; Elastic counts over 300 patterns. Stolen data is gzip-compressed and encrypted with a random AES-256-GCM key, which is in turn encrypted with the attacker's hardcoded RSA public key, so only the holder of the private key can read it.\n\nTo spread, the worm checks whether a stolen npm token has package-write permission and can bypass two-factor authentication. For each package it can publish, it downloads the latest tarball, injects the payload and loader, adds the preinstall hook, bumps the patch version and republishes. Microsoft adds that where GitHub Actions OIDC publishing is abused, the malicious packages can carry valid provenance.\n\n## Persistence in developer tooling\n\nWith stolen GitHub credentials, the payload commits hook files into repository branches: a `SessionStart` hook in `.claude\u002Fsettings.json` for Claude Code and a `folderOpen` task in `.vscode\u002Ftasks.json` for VS Code, each launching a copy of `setup.mjs`. Elastic says that with a stolen GitHub App token the worm commits these hooks to up to 50 branches per accessible repository, so simply opening an infected repository can infect another developer.\n\n## Command and control: an Ethereum dead-drop resolver\n\nChainDrop does not hardcode its exfiltration domain. It reads the current endpoint from an Ethereum smart contract at `0xE1f2395ee43e45A1556EC6438a88c31B83493103`, which lets the operator rotate C2 without changing the payload. Elastic's hunting queries reference the public RPC endpoints `eth.llamarpc.com`, `go.getblock.io` and `eth-mainnet.nodereal.io`. Elastic observed the domains `awqhnjewqjkl[.]icu` and `npm-cache[.]com` during detonation, and Microsoft reports the contract returned `npm-cache[.]com` at the time of its analysis.\n\nIf contract lookup fails, the worm searches GitHub commit history for a signed marker (`thebeautifulmarchoftime`) and accepts a domain only after validating it against an embedded RSA public key. As a last resort it exfiltrates to a public GitHub repository with a Dune-themed name, created from the victim's account with the description `Shai-Hulud: Here We Go Again`.\n\n## Why it matters\n\nIn an August 2026 piece on SDLC supply-chain risk, Palo Alto Networks Unit 42 lists ChainDrop alongside earlier incidents that each abused a different weak point: the XZ Utils backdoor (CVE-2024-3094), where an attacker spent years posing as a helpful contributor; the Axios compromise, where hijacked accounts were used to ship malware in a popular library; and the original Shai-Hulud npm worm, which misused install scripts to steal credentials automatically. Unit 42 recommends cryptographic provenance from signed commits through to signed artifacts and SBOMs, plus disabling install scripts, package cooldown periods, restricted CI\u002FCD egress and short-lived OIDC credentials in place of long-lived tokens.\n\nMicrosoft advises reviewing lockfiles, artifact repositories and CI caches for the compromised versions, pinning known-good versions, purging npm and yarn caches, rotating credentials from a clean host and hunting for files such as `Math_Symbol.js` and `math_init.js`.\n\n## Key points\n\n- Elastic Security Labs identified ChainDrop on 4 August 2026; over 400 npm packages were compromised, starting with the trojanised keyv monorepo.\n- A `preinstall` hook runs `setup.mjs`, which fetches Bun if needed and runs an obfuscated credential stealer; the worm republishes every package a stolen token can write to.\n- Persistence comes from hook files committed to `.claude\u002F` and `.vscode\u002F` in repository branches, so opening an infected repository can re-trigger the payload.\n- C2 is resolved from an Ethereum contract, with a signed GitHub commit marker and a public \"Shai-Hulud: Here We Go Again\" repository as fallbacks.\n- No named threat actor has been attributed; Microsoft calls it a Mini Shai-Hulud variant.\n\n## Further reading & sources\n\n- [Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages](https:\u002F\u002Fwww.elastic.co\u002Fsecurity-labs\u002Fshai-hulud-chaindrop-npm-supply-chain) — Elastic Security Labs\n- [ChainDrop supply chain compromise: Anatomy of a self-propagating worm](https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F08\u002F04\u002Fchaindrop-supply-chain-compromise-anatomy-self-propagating-worm\u002F) — Microsoft Security Blog\n- [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fsdlc-supply-chain) — Palo Alto Networks Unit 42","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa.png?v=49478b78c8",{"cves":18,"iocs":29,"malware":38,"targets":45,"timeline":53,"industries":62,"technologies":67},[19],{"id":20,"kev":21,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2024-3094",false,true,"\u002Fvulnerabilities\u002FCVE-2024-3094",10,0.909,"High",82.86,"3.1",[30,33,36],{"type":31,"value":32},"other","0xE1f2395ee43e45A1556EC6438a88c31B83493103",{"type":34,"value":35},"domain","awqhnjewqjkl[.]icu",{"type":34,"value":37},"npm-cache[.]com",[39,40,41,43],{"name":13},{"name":10},{"name":42},"setup.mjs",{"name":44},"Math_Symbol.js",[46,51],{"name":47,"sector":48,"status":49,"geography":50},"keyv","Software","confirmed",null,{"name":11,"sector":52,"status":49,"geography":50},"software",[54,58],{"date":55,"event":56,"description":57},"2026-08","Compromise","ChainDrop npm supply-chain compromise",{"date":59,"event":60,"description":61},"2026-08-04","Campaign start","Elastic Security Labs identified the new Shai-Hulud campaign",[63],{"url":64,"name":65,"slug":66},"\u002Findustries\u002Ftechnology","Technology","technology",[68,70,71,74,76,78,80,82,83,85],{"vendor":69,"product":69},"TON",{"vendor":11,"product":11},{"vendor":72,"product":73},"GitHub","GitHub Actions",{"vendor":75,"product":75},"VS Code",{"vendor":11,"product":77},"flat-cache",{"vendor":11,"product":79},"cacheable-request",{"vendor":11,"product":81},"cacheable",{"vendor":11,"product":47},{"vendor":11,"product":84},"cache-manager",{"vendor":86,"product":87},"Ethereum","EVM","supply_chain","2026-09-26T12:08:48.531258+00:00","2026-10-16T12:28:05.802135+00:00",{"articles":92},[93,104,117,131],{"slug":94,"title":95,"summary":96,"tags":97,"hero_image_url":101,"story_type":102,"created_at":103},"teampcp-drops-new-malware-into-42-microsoft-github-repositories","TeamPCP Added Malware to 42 Microsoft-Linked GitHub Repositories in June","On 5 June 2026 TeamPCP used a compromised GitHub account to inject malicious code into at least 42 repositories and 236 branches in the Azure, Azure-Samples and Microsoft GitHub organisations, according to Wiz. The incident followed the group's earlier supply-chain compromises of Trivy, Checkmarx, LiteLLM and BerriAI and its Mini Shai-Hulud npm and PyPI campaign.",[98,12,72,99,100],"TeamPCP","Microsoft","Azure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fteampcp-drops-new-malware-into-42-microsoft-github-repositories.png?v=b35dbe0163","threat_actor_activity","2026-08-26T17:02:14.429711+00:00",{"slug":105,"title":106,"summary":107,"tags":108,"hero_image_url":115,"story_type":102,"created_at":116},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[109,110,111,112,113,114],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","2026-10-18T12:09:44.53734+00:00",{"slug":118,"title":119,"summary":120,"tags":121,"hero_image_url":128,"story_type":129,"created_at":130},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[122,123,124,125,126,127],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","CISA KEV","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","vulnerability_disclosure","2026-10-17T12:03:14.799873+00:00",{"slug":132,"title":133,"summary":134,"tags":135,"hero_image_url":142,"story_type":129,"created_at":143},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","A critical flaw in the reset-credentials flow of Red Hat Build of Keycloak lets a remote, unauthenticated attacker skip the email verification step and set a new password for any user. Fixed builds are available for the 26.4 and 26.6 streams and upstream Keycloak 26.7.2; disabling \"Forgot password\" is the interim workaround.",[136,137,138,139,140,141],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00"]