ChainDrop: What Changed in the August Shai-Hulud Wave

Bottom line up front: Rotate all credentials from environments that ran npm install after 08:00 UTC on August 4, 2026. Domain blocklisting no longer stops exfiltration — ChainDrop resolves its C2 via Ethereum smart contract. Cleanup now requires removing all infected config files at the same time, not one at a time.

July post covered the worm’s core mechanics. This post covers what changed.

What Happened

On August 4, jaredwray’s GitHub account was taken over. Attackers pushed a malicious release of keyv directly from that account.

keyv sits inside express-rate-limit, got, cacheable-request, and many other packages. Compromise of keyv gives access to a large fraction of Node.js production infrastructure. The worm used stolen publish tokens to spread to dependent packages. Within hours: 868+ packages, 1,381+ versions, over 2 billion monthly installs.

The July wave peaked at roughly 170 packages. ChainDrop exceeded that in one afternoon.

Four Things That Changed

1. Simpler initial access

July’s waves used complex CI/CD vectors — cache poisoning, pull_request_target abuse, OIDC token extraction. ChainDrop started with a stolen maintainer account and a direct push.

Every automated check that inspects the build process passed. The build was clean. The account that ran it was not.

2. Ethereum smart contract C2

July’s worm used attacker-controlled domains. Block the domain, interrupt the exfil.

ChainDrop queries an Ethereum smart contract to get its current exfiltration endpoint. Block npm-cache.com (the initial domain) and the next infected machine fetches a different domain from the same contract address. Attackers update the contract. Defenders cannot keep up by blocking domains alone.

Monitor DNS queries initiated by npm install processes. Look for queries to unknown domains. This gives signal — it does not stop the exfil.

3. GitHub repos as exfil target

Stolen credentials are RSA-encrypted and pushed to attacker-controlled GitHub repositories. Each repo has this description: “Shai-Hulud: Here We Go Again”

Search GitHub for that exact string to find evidence of exfiltration. Hundreds to approximately 1,300 such repos appeared at peak.

RSA encryption means takedowns do not destroy the data for anyone who copied it first.

4. Cross-wired IDE persistence

July: delete .claude/settings.json or .vscode/tasks.json to remove persistence.

ChainDrop cross-wires them. Each hook checks for the other and reinstalls it if absent. Remove one file before the other and the remaining hook reinstalls the deleted one on next tool invocation.

Correct cleanup procedure:

1. Close all IDE tools and agent processes.
2. Remove both .claude/settings.json and .vscode/tasks.json at the same time.
3. Verify neither file was recreated before opening any tool again.
4. Rotate credentials before reopening anything.

Expanded Credential Harvesting

ChainDrop targets more than the July wave did.

Process memory harvesting is the most important change. Credentials passed as environment variables — never written to disk — are readable if the malicious preinstall hook runs in the same process context as the parent runner.

Secrets-at-rest controls do not stop this. Use short-lived credentials so harvested values expire before attackers can use them.

Why keyv

Blast radius scales with position in the dependency graph. Leaf packages affect only their direct installers. keyv sits inside packages that sit inside packages. The worm did not need to compromise 868 packages independently. It compromised one well-positioned account, published one malicious version, and the propagation mechanism did the rest.

What Still Works From July

npm install --ignore-scripts stops preinstall hooks from running. ChainDrop has no bypass for this. Apply it wherever possible.

Short-lived credentials limit the value of anything stolen. A 15-minute OIDC token that expires before attackers can use it provides strong protection against this wave’s speed.

Content-addressed pinning prevents a malicious republish of a version number from affecting environments with a locked package-lock.json and --frozen-lockfile semantics.

Egress filtering during install blocks specific harvesting paths. Block 169.254.169.254 during npm install to prevent IMDS credential theft even if a hook executes.

Immediate Actions

If you run Node.js in CI or production:

1. Rotate all credentials present in environments that ran npm install after 08:00 UTC on August 4, 2026. Include npm tokens, GitHub PATs, AWS credentials, GCP service account keys, Vault tokens, and any credentials passed as environment variables.
2. Follow the cross-wired persistence cleanup procedure above.
3. Check your full transitive dependency tree. Installing without keyv directly does not mean you are safe.
4. Block egress to npm-cache.com and monitor for DNS queries to unknown domains from install processes.

If you maintain npm packages:

1. Enable hardware security keys (not TOTP) on any account with publish access to widely-used packages.
2. Audit your publish workflow for credentials stored longer than a single publish operation. Rotate to short-lived publish-scoped tokens.

The Pattern

ChainDrop is not a different attack. It is the same attack with specific improvements that close gaps defenders exploited against July’s wave.

The July post predicted faster iteration after the worm’s source code was published in May. ChainDrop is the first confirmed descendant. Smart contract C2, RSA-encrypted exfil, cross-wired persistence, and expanded harvesting targets represent meaningful operational improvement in roughly 90 days.

Each wave incorporates defender feedback from the previous one. Tactical mitigations — domain blocklists, single-file cleanup — will keep losing ground. The durable fix is structural: install environments that cannot reach instance metadata, Vault paths, or credential files at all. That is a harder change than rotating after an incident.

---

July 2026 analysis: Mini Shai-Hulud — why the worm succeeds
Supply chain signing controls: HAS-12
IOCs and technical forensics: @intcyberdigest