Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
Zscaler, Tuesday, August 11th, 2026
Zscaler analyses ChainDrop, an npm worm anchoring its C2 in an Ethereum smart contract and forging SLSA provenance.
Zscaler ThreatLabz analyses ChainDrop, a self-propagating worm that entered the npm ecosystem on 4 August 2026 through a compromised maintainer account.
A variant of Mini Shai-Hulud linked to TeamPCP, it anchors its command-and-control infrastructure in an Ethereum smart contract so the attacker can rotate domains with a single blockchain transaction, rendering domain-based blocklists ineffective.
The attacker compromised the GitHub account of the keyv ecosystem maintainer and injected malicious code into the source repository, causing the project's own GitHub Actions release pipeline to build and publish poisoned versions of keyv, cacheable, flat-cache and file-entry-cache.