[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fL-2j0FS1jDJAHYnPUpU5EgKAHc7IwN7h26aVjvrzQ0E":3,"$f_SH6Y-NIevzIv8HEDxfj7gssT1AlgMQZkZ6RKGx3UoA":71},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":68,"created_at":69,"updated_at":70,"published_at":30},"palo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa","Palo Alto Unit 42 Breaks Down ChainDrop: Self-Propagating npm Worm Infects 400+ Packages","The worm steals npm and GitHub tokens from the keyv maintainer, then auto-republishes every co-owned package with a three-step preinstall hook and Ethereum C2 resolver.","Palo Alto Networks Unit 42 published a research report on the ChainDrop npm worm, a self-propagating supply-chain attack that compromised 400+ packages including keyv and cacheable-request by trojanizing the maintainer's monorepo and using stolen credentials to backdoor all co-owned packages.",[10,11,12,13,14],"ChainDrop","npm","supply-chain","Shai-Hulud","Ethereum C2","# Palo Alto Unit 42 Breaks Down ChainDrop: Self-Propagating npm Worm Infects 400+ Packages\n\n*The worm steals npm and GitHub tokens from the keyv maintainer, then auto-republishes every co-owned package with a three-step preinstall hook and Ethereum C2 resolver.*\n\n**Tags:** `ChainDrop` `npm` `supply-chain` `Shai-Hulud` `Ethereum C2`\n\n> Palo Alto Networks Unit 42 published a research report on the ChainDrop npm worm, a self-propagating supply-chain attack that compromised 400+ packages including keyv and cacheable-request by trojanizing the maintainer's monorepo and using stolen credentials to backdoor all co-owned packages.\n\n---\n\n## ChainDrop: A Self-Propagating npm Worm Hits 400+ Packages\n\nChainDrop is a self-propagating npm supply-chain worm that compromised more than 400 packages, including the widely used keyv and cacheable-request libraries, through a three-stage infection chain. The worm hooks into the package manifest, steals npm and GitHub tokens, then uses those credentials to silently backdoor and republish every other package the maintainer controls.\n\nThe propagation works by modifying the package.json manifest to inject a preinstall hook that runs on install. Once the hook executes, it sweeps the environment for npm and GitHub tokens, encrypts the harvested credentials with AES-256-GCM, and RSA-encrypts the AES key with the attacker’s hardcoded public key. The worm then republishes the co-owned packages with the malicious code embedded, leaving the original functionality intact so developers don’t notice the change.\n\nFor long-term persistence, ChainDrop installs cross-linked hooks directly into VS Code and Claude Code, giving it a foothold in the developer’s tooling. Command-and-control is managed dynamically through an Ethereum smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103, which the worm queries at runtime to fetch the current exfiltration endpoint. This lets the attacker rotate the C2 domain without redeploying the payload. If the contract lookup fails, the worm falls back to a GitHub commit history search for a signed marker, validating the C2 domain against an embedded RSA public key before accepting it.\n\n## How the Worm Works: From preinstall Hook to Ethereum C2\n\nExecution is triggered through a `preinstall` hook injected into the `package.json` manifest. This abuses a standard npm lifecycle feature that runs arbitrary shell commands before the package is installed, requiring no further user interaction. Once the hook fires, it sweeps the environment for npm and GitHub tokens, encrypts the harvested credentials with a randomly generated AES-256-GCM key, and then RSA-encrypts that AES key with the attacker’s hardcoded public key. Only the attacker holding the corresponding private key can decrypt the exfiltrated data.\n\nFor command-and-control, ChainDrop does not hardcode a C2 domain. Instead, it queries an Ethereum smart contract at `0xE1f2395ee43e45A1556EC6438a88c31B83493103` at runtime to fetch the current exfiltration endpoint. The worm fans out across three RPC providers—`eth.llamarpc.com`, `go.getblock.io`, and `eth-mainnet.nodereal.io`—so a rate-limited or downed endpoint does not break resolution. This lets the attacker rotate the C2 domain without redeploying the payload.\n\nIf the contract lookup fails, the worm falls back to a GitHub commit history search for a cryptographically signed marker (`thebeautifulmarchoftime`), validating the C2 domain against an embedded RSA public key before accepting it. If both paths fail, it exfiltrates via a public GitHub repository based on Dune names, using the compromised victim’s account with the description: `Shai-Hulud: Here We Go Again`.\n\n## The C2 Trick: Ethereum Dead-Drop Resolver\n\nInstead of hardcoding the C2 domain into the payload, ChainDrop queries an Ethereum smart contract at `0xE1f2395ee43e45A1556EC6438a88c31B83493103` via `eth_call` to fetch the current exfiltration endpoint at runtime. This lets the attacker rotate the C2 domain by updating the contract without redeploying the worm.\n\nThe worm fans out the `eth_call` request across three public RPC providers—`eth.llamarpc.com`, `go.getblock.io`, and `eth-mainnet.nodereal.io`—so a rate-limited or downed endpoint does not break resolution. At detonation, we observed two dead-drop domains: `awqhnjewqjkl[.icu]` and `npm-cache[.com]`.\n\nIf the contract lookup fails, the worm falls back to a GitHub commit history search for a cryptographically signed marker (`thebeautifulmarchoftime`), validating the C2 domain against an embedded RSA public key before accepting it.\n\n## Who Was Hit: keyv and 1.3B Monthly Downloads\n\nThe compromise began when attackers seized the maintainer account for `keyv`, a key-value storage library that pulled over 600 million downloads last month. They trojanized the monorepo and embedded the CHAINDROP worm, which then used the stolen npm credentials to backdoor every other package the maintainer had publish rights to. The full set of co-owned packages totals 1.3 billion monthly downloads.\n\nElastic Security Labs identified the campaign on August 4, 2026, and confirmed 400+ unique npm packages compromised by the time of writing.\n\n## Why This Matters: The SDLC Supply-Chain Pattern\n\nChainDrop follows the same pattern that has defined the last 18 months of software supply-chain attacks: target the CI\u002FCD pipeline or developer environment, hijack the code at the source, and let it propagate before it ever reaches production. XZ Utils, Axios, and Shai-Hulud all did this by backdooring a single package and hoping the maintainer publishes the rest. ChainDrop automates the whole thing.\n\nThe worm self-propagates by stealing the victim’s npm and GitHub tokens, then republishing every co-owned package with the payload embedded. That is what makes it a worm rather than a one-off backdoor — each infected package can infect the next, and the attacker does not need to manually push 400+ packages. Palo Alto Unit 42 groups it with the broader SDLC supply-chain trend and recommends signed commits at the developer endpoint, signed artifacts in CI\u002FCD, and SBOMs in production to stop self-propagating worms in their tracks.\n\n## Key points\n\n- ChainDrop is a self-propagating npm worm that infected 400+ packages including keyv (600M+ monthly downloads) and cacheable-request via a preinstall hook in package.json.\n- The worm steals npm and GitHub tokens from the keyv maintainer, then uses them to auto-republish every co-owned package the maintainer has publish rights to.\n- C2 is resolved at runtime via an Ethereum smart contract (0xE1f2395ee43e45A1556EC6438a88c31B83493103) queried across three RPC providers, with a GitHub commit-history fallback and a public Dune-named repo as last resort.\n- Exfiltration is AES-256-GCM encrypted then RSA-encrypted with the attacker's hardcoded public key; only the attacker's private key can decrypt the data.\n- Unit 42 ties ChainDrop to the XZ Utils, Axios, and Shai-Hulud npm worm patterns, positioning it as the next wave of self-propagating SDLC supply-chain attacks targeting CI\u002FCD and developer environments.\n\n## Further reading & sources\n\n- [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fsdlc-supply-chain) — PaloAlto Networks Unit 42\n- [Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages — Elastic Security Labs](https:\u002F\u002Fwww.elastic.co\u002Fsecurity-labs\u002Fshai-hulud-chaindrop-npm-supply-chain)\n- [Blockchain Dead Drop Resolvers Explained - Netskope](https:\u002F\u002Fwww.netskope.com\u002Fblog\u002Fblockchain-dead-drop-resolvers-explained)\n- [The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fmonitoring-npm-supply-chain-attacks)\n- [ChainDrop supply chain compromise: Anatomy of a self-propagating worm | Microsoft Security Blog](https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F08\u002F04\u002Fchaindrop-supply-chain-compromise-anatomy-self-propagating-worm\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa.png?v=49478b78c8",{"iocs":18,"malware":22,"targets":25,"timeline":33,"industries":42,"technologies":47},[19],{"type":20,"value":21},"other","0xE1f2395ee43e45A1556EC6438a88c31B83493103",[23,24],{"name":13},{"name":10},[26,31],{"name":27,"sector":28,"status":29,"geography":30},"keyv","npm package","confirmed",null,{"name":11,"sector":32,"status":29,"geography":30},"software",[34,38],{"date":35,"event":36,"description":37},"2026-08","Compromise","ChainDrop npm supply-chain compromise",{"date":39,"event":40,"description":41},"2026-08-21","Publication","Unit 42 research publication",[43],{"url":44,"name":45,"slug":46},"\u002Findustries\u002Ftechnology","Technology","technology",[48,50,52,54,55,57,58,61,63,65],{"vendor":11,"product":49},"flat-cache",{"vendor":11,"product":51},"cacheable-request",{"vendor":11,"product":53},"cacheable",{"vendor":11,"product":27},{"vendor":11,"product":56},"cache-manager",{"vendor":11,"product":11},{"vendor":59,"product":60},"GitHub","GitHub Actions",{"vendor":62,"product":62},"VS Code",{"vendor":64,"product":64},"TON",{"vendor":66,"product":67},"Ethereum","EVM","supply_chain","2026-09-26T12:08:48.531258+00:00","2026-10-16T12:28:05.802135+00:00",{"articles":72},[73,84,96,110],{"slug":74,"title":75,"summary":76,"tags":77,"hero_image_url":81,"story_type":82,"created_at":83},"teampcp-drops-new-malware-into-42-microsoft-github-repositories","TeamPCP Drops New Malware into 42 Microsoft GitHub Repositories","TeamPCP leveraged a stolen GitHub account to publish malicious code into at least 42 repositories and 236 branches spanning the Azure, Azure-Samples, and Microsoft GitHub organizations, extending its ongoing supply-chain campaign against Microsoft-linked projects.",[78,12,59,79,80],"TeamPCP","Microsoft","Azure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fteampcp-drops-new-malware-into-42-microsoft-github-repositories.png?v=b35dbe0163","threat_actor_activity","2026-08-26T17:02:14.429711+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":94,"story_type":68,"created_at":95},"amazon-threat-intelligence-attributes-npm-supply-chain-compromises-to-north-kore","Amazon Threat Intelligence attributes NPM supply chain compromises to North Korea's Sapphire Sleet","Amazon Threat Intelligence publicly attributes recent NPM open-source supply chain compromises to the North Korean threat actor tracked as Sapphire Sleet, based on C2 indicators and TTPs with medium confidence.",[89,90,91,92,93],"SAPPHIRE SLEET","NPM","supply chain","North Korea","DPRK","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Famazon-threat-intelligence-attributes-npm-supply-chain-compromises-to-north-kore.png?v=46de02f011","2026-09-17T07:13:22.758316+00:00",{"slug":97,"title":98,"summary":99,"tags":100,"hero_image_url":107,"story_type":108,"created_at":109},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[101,102,103,104,105,106],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","vulnerability_disclosure","2026-09-30T12:09:12.456253+00:00",{"slug":111,"title":112,"summary":113,"tags":114,"hero_image_url":121,"story_type":108,"created_at":122},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[115,116,117,118,119,120],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00"]