Elastic Security Labs has identified a new Shai-Hulud campaign that compromised the `keyv` npm package maintainer and deployed a self-propagating worm called CHAINDROP. The worm uses stolen npm credentials to backdoor every package a compromised maintainer has publish rights to, affecting 400+ npm packages including high-download libraries like `flat-cache` and `cacheable-request`. CHAINDROP is triggered via a `preinstall` hook, downloads the Bun runtime to execute a heavily obfuscated payload, and harvests credentials from over 300 patterns including AI tooling (Anthropic, OpenAI, Cursor), cloud providers (AWS, GCP, Azure), GitHub tokens, SSH keys, and Kubernetes tokens. It uses an Ethereum smart contract for dynamic C2 resolution, making infrastructure rotation trivial. The worm also plants malicious hooks in Claude Code and VS Code config files so developers can be infected simply by opening a compromised repository. Recommendations include adding a version soak period before adopting new package updates, revoking all affected tokens, enabling 2FA on npm accounts, and upgrading to npm 12+ which blocks preinstall hooks by default.
