New ChainDrop worm poisons over 1,300 npm packages, Keyv and Cacheable among those hit
- Aikido researchers uncovers ChainDrop, a Shai‑Hulud variant infecting 1,300+ npm packages with an infostealer
- Attackers compromised GitHub accounts tied to popular libraries (Keyv, Cacheable, flat‑cache, file‑entry‑cache) and pushed tainted releases with 2B monthly downloads
- Malware exfiltrates developer/cloud credentials and secrets to a public GitHub repo; admins should treat affected systems as compromised even after removal
Another Shai-Hulud variant has been discovered in the wild, infecting more than 1,300 npm packages with an infostealer.
Security researchers Aikido reported finding “at least 868 packages (across 1381 versions) that have been compromised by the worm.”
Shai-Hulud is a self-propagating supply chain malware that targets software developers by compromising open-source packages and CI/CD pipelines. It steals credentials, API keys, and access tokens and then uses those stolen secrets to publish additional malicious packages.
What to do in case of an infection
In May 2026, actors claiming to be associated with the TeamPCP group publicly...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
