Elastic Details CHAINDROP Worm in Shai-Hulud npm Supply-Chain Campaign

Summary

Elastic Security Labs describes a Shai-Hulud campaign that reportedly compromised more than 400 npm packages. Its CHAINDROP worm uses preinstall hooks to spread, steals developer credentials, and resolves C2 through an Ethereum smart contract.

Key points

Elastic says attackers trojanized the keyv maintainer's repository and used stolen npm credentials to backdoor packages the maintainer could publish.
The report says more than 400 npm packages were compromised; infected packages can execute the dropper through a package.json preinstall hook.
CHAINDROP can also add Claude Code and VS Code hooks to repositories, enabling execution when an infected repository is opened or a new Claude session starts.
The malware scans more than 300 patterns for credentials, including AI, cloud, GitHub, SSH, Kubernetes, Vault, and npm secrets.
It resolves its exfiltration endpoint through an Ethereum smart contract, with GitHub-based fallback methods; stolen credentials are encrypted before exfiltration.
Elastic recommends revoking and rotating exposed credentials, checking repositories for unauthorized commits, and enabling npm 2FA.

Article Details

Attack Vectors: Attackers compromised the keyv maintainer’s npm credentials and trojanized the keyv monorepo and packages the maintainer could publish.
A package.json preinstall hook ran the dropper during package installation without further victim interaction.
CHAINDROP collected developer credentials, including AI tooling, cloud, GitHub, SSH, Kubernetes, Vault, and npm credentials.
The dropper downloaded bun when needed, then used it to execute the obfuscated JavaScript payload.
The malware resolved its exfiltration endpoint through an Ethereum smart contract, with GitHub commit-history and public-repository fallbacks.
With qualifying npm credentials, the worm repackaged and published infected versions of every writable package it enumerated.
Defensive Notes: Delay adoption of new package versions with a soak period.
Revoke GitHub tokens and regenerate npm tokens found on affected machines, especially tokens with package write permissions and bypass_2fa.
Check repositories for unauthorized commits with the message chore: update config from [email protected].
Rotate affected cloud, Kubernetes, Vault, AI tooling, and CI/CD credentials.
Upgrade to npm 12 or later, which the article says blocks preinstall hooks by default.
Enable two-factor authentication on npm accounts and avoid automation tokens with bypass_2fa: true where possible.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`awqhnjewqjkl[.]icu`	Dead-drop/C2 domain observed during CHAINDROP detonation.
DOMAIN	`npm-cache[.]com`	Dead-drop/C2 domain observed during CHAINDROP detonation.
SHA256	`54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668`	Additional SHA-256 hash identified in the research for the setup.mjs dropper.
SHA256	`9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc`	SHA-256 hash identified in the research for the Math_Symbol.js payload.
SHA256	`fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb`	SHA-256 hash identified in the research for the setup.mjs dropper.