A Password Breach That Became a Worm
On August 4, 2026, Elastic Security Labs identified a new supply chain campaign that began with something mundane: compromised credentials belonging to the maintainer of keyv, a caching library used across the JavaScript ecosystem. Attackers used that access to publish a malicious preinstall hook into keyv and every package that maintainer co-owned, including flat-cache, cacheable-request, cacheable, and cache-manager. Individually, those packages pull between 16 million and 600 million downloads a month. Together, researchers put the combined exposure at roughly 1.3 billion monthly downloads across more than 400 infected packages.
The malware, dubbed CHAINDROP, is not just malicious code sitting in a package. It is a worm. Once it runs on a developer machine or a CI pipeline with npm tokens that carry write access and bypass two-factor authentication, it automatically republishes itself into every package that victim can publish to, spreading without further attacker involvement. SecurityWeek reported 2,212 malicious package versions went live within four hours, a propagation speed that most enterprise dependency scanning simply is not built to catch in real time.
What the Payload Actually Steals
CHAINDROP's credential-harvesting component, which Elastic calls the collector, targets more than 300 distinct credential patterns. That list includes the expected cloud provider keys for AWS, Google Cloud, Azure, and Alibaba, along with GitHub tokens, SSH keys, and Kubernetes service accounts. It also specifically targets credentials for AI coding tools: Anthropic, Claude, Cursor, OpenAI, and Gemini all appear by name in the collector's target patterns, a detail that should stop any engineering leader who has rolled out AI coding assistants without a clear credential isolation policy.
The worm also injects itself into developer tooling automation, specifically VS Code folderOpen tasks and Claude Code SessionStart hooks found in repository configuration files, meaning it can execute automatically the moment a developer opens an infected project, not only during npm install. That is a meaningful escalation from prior npm supply chain attacks, which mostly relied on the install step alone. It shows attackers studying how AI-assisted development environments actually get triggered and building persistence directly into those triggers.
Infrastructure Built to Survive Takedowns
Rather than hardcoding a command and control server that defenders could sinkhole or block, CHAINDROP queries an Ethereum smart contract at runtime to retrieve current exfiltration endpoints, a technique known as EtherHiding. Because the blockchain record is public, immutable, and outside any single company's takedown authority, attackers can rotate their infrastructure freely while the malicious code itself never has to change. Traditional domain blocklisting and takedown requests, the standard first response to a malicious C2 server, do not work against this design.
The campaign also included behavioral touches aimed at defenders directly: some commit messages contained the phrase warning that blocking the attacker's API key would crash production servers for third-party clients, an intimidation tactic meant to slow incident response by threatening collateral damage. Combined with a 24-hour self-deletion routine and a host-level dead man's switch in some variants, the overall design reflects an operation built specifically to survive the first 24 to 48 hours of detection and response, which is exactly the window most enterprise security teams count on.
The Second Shai-Hulud Wave in Under a Year
CHAINDROP is not a first-time event. It follows the original Shai-Hulud campaign and carries recognizable stylistic fingerprints from it, including Dune-themed naming references, suggesting either the same operators returning or a copycat group reusing a proven playbook. Researchers at JFrog explicitly framed this as Shai-Hulud returning rather than an unrelated new threat, which matters because it means the npm ecosystem faced a second wave of essentially the same attack pattern within roughly a year, without the underlying structural weaknesses being closed in between.
Those structural weaknesses are well understood and not exotic: maintainer accounts without hardware-key-backed multi-factor authentication, npm publish tokens with broad write scope and 2FA bypass capability, and preinstall hooks that execute arbitrary code with no sandboxing before a human ever reviews what was published. None of those are new problems. What changed is that attackers have now demonstrated, twice, that exploiting them at scale against widely used packages is both repeatable and highly effective.
Why This Is an AI Tooling Story, Not Just a Supply Chain Story
The explicit targeting of Claude, Cursor, OpenAI, and Gemini credentials is the detail enterprise security leaders should not skip past. As organizations roll out AI coding assistants at scale, those tools now hold API keys and session tokens that, if exfiltrated, grant an attacker the same access to your codebase and infrastructure that your own developers have through their AI tooling. A compromised AI coding assistant credential is functionally equivalent to a compromised developer laptop, and most companies have not extended their credential rotation and scoping policies to cover it yet. CHAINDROP's authors clearly researched which tools engineering teams have adopted fastest over the past year, and built their collector around that adoption curve rather than around older, better-defended credential types.
This also validates a governance gap that has been mostly theoretical until now: organizations racing to adopt AI-assisted development have generally not updated their secrets management, credential scoping, or incident response runbooks to account for AI tool credentials as a distinct, high-value target class. CHAINDROP demonstrates that attackers have already made that update on their end, well ahead of most enterprise security programs. Most vendor risk assessments and SOC 2 questionnaires still do not ask a supplier how it scopes or rotates AI coding assistant credentials, which means the audit process itself has not caught up to what attackers are already exploiting in production.
What This Means for Your Roadmap
Audit every npm publish token in your organization this week for 2FA bypass capability and unnecessarily broad write scope, and enforce hardware-key-backed authentication for any maintainer or internal package publisher with access to widely depended-upon libraries. Pin dependency versions rather than accepting automatic minor and patch updates for anything in your critical path, since CHAINDROP's four-hour propagation window means an automatic update policy can pull in compromised code before any advisory is published.
Separately, treat AI coding tool credentials as a distinct asset class in your secrets management program, with the same rotation cadence, scoping discipline, and monitoring you apply to cloud provider keys. If your organization adopted Claude, Cursor, or similar tools without updating your credential inventory to include them, CHAINDROP is the concrete evidence that attackers are already ahead of that gap, and closing it should move up your roadmap accordingly.
