--- title: ChainDrop worm crawls into npm supply chain, evades... description: A new worm dubbed ChainDrop, a variant of the Shai-Hulud malware family, has infected the npm ecosystem by poisoning 444 packages. The worm spreads through... canonical: https://daily.dev/posts/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses-vobyse76t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ChainDrop worm crawls into npm supply chain, evades standard defenses | daily.dev og:description: A new worm dubbed ChainDrop, a variant of the Shai-Hulud malware family, has infected the npm ecosystem by poisoning 444 packages. The worm spreads through... og:url: https://daily.dev/posts/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses-vobyse76t og:image: https://api.daily.dev/og/posts/voBYSe76t.png og:image:alt: ChainDrop worm crawls into npm supply chain, evades standard defenses og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ChainDrop worm crawls into npm supply chain, evades standard defenses **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 2 upvotes · 0 comments ## Summary A new worm dubbed ChainDrop, a variant of the Shai-Hulud malware family, has infected the npm ecosystem by poisoning 444 packages. The worm spreads through malicious tarballs and hooks into developer tooling, and is reported to evade standard security defenses used to catch supply-chain compromises. The page content is largely a navigation/listing page with links to other unrelated Register articles, with minimal detail beyond the headline and description about the worm itself. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the ChainDrop npm worm and how does it spread? ChainDrop is a worm variant of the Shai-Hulud malware family that has poisoned 444 npm packages. It spreads by embedding itself in malicious tarballs distributed through the npm registry and by hooking into developer tool workflows, letting it propagate across projects while evading standard security defenses designed to catch typical supply chain attacks. _Teams auditing npm dependencies for supply chain risk can follow developments like this on daily.dev._ ### How many npm packages were affected by the Shai-Hulud ChainDrop variant? 444 npm packages were found poisoned by the ChainDrop worm, a variant of the Shai-Hulud supply chain malware. The infection method relies on tarball manipulation and hooks into developer tooling rather than the more commonly detected package metadata or install script tricks, making it harder for standard defenses to catch. _Developers tracking npm supply chain incidents can stay current on emerging threats via daily.dev._ ## Similar posts on daily.dev - [Massive ChainDrop npm supply-chain attack infects hundreds of packages](https://daily.dev/posts/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages-uhzbslfdu) · BleepingComputer · 3 upvotes · 1 comments - [Shai-Hulud copycat worm infects yet another npm package](https://daily.dev/posts/shai-hulud-copycat-worm-infects-yet-another-npm-package-6qyti32ms) · The Register · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses-vobyse76t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ChainDrop worm crawls into npm supply chain, evades standard defenses","url":"https://daily.dev/posts/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses-vobyse76t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses-vobyse76t"},"datePublished":"2026-08-15T10:35:23.717Z","dateModified":"2026-09-14T07:30:50.805Z","description":"A new worm dubbed ChainDrop, a variant of the Shai-Hulud malware family, has infected the npm ecosystem by poisoning 444 packages. The worm spreads through...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1cab69c55d04ea1386cadc09744b4500?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1cab69c55d04ea1386cadc09744b4500?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses-vobyse76t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,javascript,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"ChainDrop worm crawls into npm supply chain, evades standard defenses"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses-vobyse76t#faq","mainEntity":[{"@type":"Question","name":"What is the ChainDrop npm worm and how does it spread?","acceptedAnswer":{"@type":"Answer","text":"ChainDrop is a worm variant of the Shai-Hulud malware family that has poisoned 444 npm packages. It spreads by embedding itself in malicious tarballs distributed through the npm registry and by hooking into developer tool workflows, letting it propagate across projects while evading standard security defenses designed to catch typical supply chain attacks. Teams auditing npm dependencies for supply chain risk can follow developments like this on daily.dev."}},{"@type":"Question","name":"How many npm packages were affected by the Shai-Hulud ChainDrop variant?","acceptedAnswer":{"@type":"Answer","text":"444 npm packages were found poisoned by the ChainDrop worm, a variant of the Shai-Hulud supply chain malware. The infection method relies on tarball manipulation and hooks into developer tooling rather than the more commonly detected package metadata or install script tricks, making it harder for standard defenses to catch. Developers tracking npm supply chain incidents can stay current on emerging threats via daily.dev."}}]} ```